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Preface 


Secure digital imaging is an important research area combining methods and 
techniques coming from cryptography and image processing. Visual cryptog- 
raphy and in general secret image sharing techniques enable distributing sen- 
sitive visual materials to involved participants through public communication 
channels, as the generated secure images do not reveal any information if they 
are not combined in the prescribed way. In visual cryptography, the decoding 
process is performed directly by the human eyes, while in general, the shared 
images need some processing to reconstruct the secret image. The increas- 
ing number of possibilities to create, publish, and distribute images calls for 
novel protection methods, offering new sharing and access control mechanisms 
for the information contained in the published images. Secure image sharing 
techniques overcome the traditional cryptographic approach, providing new 
solutions for the development of new and secure imaging applications. 

Since both digital imaging and privacy protection are two research themes 
that involve a continuously growing number of people and applications, the 
book focuses on secure image sharing techniques, offering an interesting ref- 
erence point for studying and developing solutions needed in such areas. This 
book aims to fill the existing literature gap, providing a valid guide for profes- 
sional people and/or researchers interested in such fields of research. It pro- 
vides a scientifically and scholarly sound treatment of state-of-the-art tech- 
niques to students, researchers, academics, and practitioners who are inter- 
ested or involved in the study, research, use, design, and development of image 
sharing techniques. It can serve as a guide for making use of visual crypto- 
graphic algorithms and as a basis to develop applications based on image 
secret sharing solutions. 

The book has the form of a contributed volume, where well-known experts 
address an extensive range of topics related to visual cryptography techniques 
and solutions for secure image sharing. Besides introducing the relevant is- 
sues of such research fields, and providing a coverage of theoretical results, 
the book illustrates some aspects and interesting results concerning recent 
research directions. It covers the most prominent topics in the area, such 
as the possibility of sharing multiple secrets, visual cryptography schemes 
based on the probabilistic reconstruction of the secret image, possibility to 
include pictures in the distributed shares, contrast enhancement techniques, 
visual cryptography schemes based on different logical operations for combin- 
ing the shared images, color images visual cryptography, cheating prevention, 
alignment problem for image shares, and the description of some practical 

xxxi 
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xxxii Preface 

applications of visual cryptography. In addition to the above, steganography 
and authentication are discussed, and different methods of image sharing are 
presented, including mathematical and probabilistic techniques for generating 
the image shares. 

Each chapter provides the fundamentals for the topics under consideration 
and the detailed description of the relevant methods, presenting examples and 
practical applications to demonstrate the effectiveness of the surveyed tech- 
niques. Chapters 1-2 introduce visual cryptography and its application to 
halftone and color images, respectively. The techniques presented in these 
chapters focus on the problem of providing high quality shares using halfton- 
ing, and providing an adaptation of visual cryptography to color images, re- 
solving the problem of darkening caused from the superposition of the shares 
in the reconstruction phase. Chapter 3 presents an extension of the general 
technique useful for sharing multiple images using the same set of shares. 
Chapter 4 shows how visual cryptography schemes can be applied to photo- 
graph images, obtaining interesting results for practical applications. 

Chapters 5-7 focus on different extensions of basic visual cryptography 
technique. Probabilistic visual cryptography schemes trade the guarantee of 
a correct reconstruction of the secret image with a reduced pixel expansion of 
the generated shares. In Chapter 6 the basic superposition mechanism used 
for the reconstruction of the secret image is abandoned for a XOR- based 
reconstruction phase, improving on the contrast of the reconstructed image. 
Chapter 7 presents random grid techniques, which are derived from visual 
cryptography, but provide a reduced pixel expansion in the generated shares 
and do not need a basis matrix in the generation phase of the shares. 

Chapters 8-9 focus on the contrast of the reconstructed images. In Chapter 
8 the bounds on the contrast of the most known schemes are discussed. In 
Chapter 9 techniques based on the reversing of the images are presented, 
where black pixels are reversed to white ones and vice versa. Using such an 
operation, schemes with perfect reconstruction of both white and black pixels 
can be derived, avoiding any loss of resolution for the shared image. 

Chapters 10-12 are more focused on the problems to be faced in the prac- 
tical applications of visual cryptography schemes. One is cheating prevention, 
as discussed in Chapter 10, where the problem of malicious participants to the 
schemes is discussed. The other problem relates to the alignment of the shares 
in the reconstruction phase. In general, techniques to prevent the alignment 
of the shares and introduce some degree of tolerance in the reconstruction 
phase are discussed. Finally, Chapter 12 presents some applications of visual 
cryptography in the field of securing online transactions and e-voting. 

Chapters 13-17 are more focused on general image sharing techniques. 
Image sharing in halftone images is discussed in Chapter 13, where two gen- 
eral techniques of data hiding are presented and analyzed. An algorithm for 
color image sharing is presented in Chapter 14, where interpolation is used 
for hiding secret images. Image sharing techniques based on polynomial se- 
cret sharing are discussed in Chapter 15. Chapter 16 discusses steganography 
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Preface xxxiii 

and authentication in the context of image sharing, presenting some novel 
schemes. Finally, Chapter 17 presents a novel technique for image sharing, 
where the reconstruction phase can be performed both via the superposition 
of the shares, or via some computation. 

In all the chapters, figures, tables, and examples are used to improve the 
presentation and the analysis of the discussed methods and techniques. Bibli- 
ographic references are included in each chapter and provide a good starting 
point for deeper research and further exploration of the topics covered in this 
volume. 
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Visual Cryptography and Secret Image Sharing 


1.1 Introduction 

Visual cryptography (VC), proposed by Naor and Shamir in [19], is a paradigm 
for cryptographic schemes that allows the decoding of concealed images with- 
out any cryptographic computation. Particularly in a fc-out-of-n visual se- 
cret sharing scheme (VSS), a secret image is cryptographically encoded into 
n shares. Each share resembles a random binary pattern. The n shares are 
then xeroxed onto transparencies respectively and distributed among n par- 
ticipants. The secret images can be visually revealed by stacking together 
any k or more transparencies of the shares and no cryptographic computa- 
tion is needed. However, by inspecting less than k shares, one cannot gain 
any information about the secret image, even if infinite computational power 
is available. Aside from the obvious applications to information hiding, VC 
can be applied to access control, copyright protection [10], watermarking [8], 
visual authentication, and identification [18]. 

1.1.1 Visual Cryptography 

The main instantiation of VC realizes a cryptography protocol called secret 
sharing (SS). In a conventional SS scheme, a secret image is shared among n 
participants in such a way that subsets of qualified participants can pull their 
shares and recover the secret but subsets of forbidden participants can obtain 
no information about it. Here, both the sharing phase and the reconstruction 
phase involve algorithms that are run by computers (specially, a dealer runs a 
distribution algorithm and a set of qualified parties can run a reconstruction 
algorithm). The surprising novelties of a VSS scheme are in representing data 
as images and in an elementary realization of the reconstruction phase, con- 
sisting of just viewing the image obtained after stacking transparencies. VSS 
schemes inherit all applications of conventional SS schemes; most notably, 
access control. As an example, consider a bank vault that must be opened 
everyday by five tellers, but for security purposes it is desirable not to en- 
trust any two individuals with the combination. Hence, a vault-access system 
that requires any three of the five tellers may be desirable. This problem can 
be solved using a 3-out-of-5 threshold scheme. In addition to access control, 
VSS schemes can be applied to a number of other cryptographic protocols 
and applications using conventional SS, such as threshold signatures, private 
multiparty function evaluation, electronic cash, and digital elections. 

Another quite intriguing instantiation of VC schemes realizes VSS with 
innocent-looking images as shares. This version of VSS has applications to 
a multiparty variant of steganography. In a steganography scheme, a user A 
sends an innocent-looking image to another user B , in such a way that B can 
recover some hidden images, but no observer of the communication between A 
and B even suspects that the communication contains some hidden images. In 
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a multiparty variant of conventional steganography schemes, a user A sends 
innocent-looking images to users, B i, . . ., B m in such a way that qualified 
subsets of the recipients can recover some hidden image, but no observer of 
the communication between A and B\, .... B m even suspects the existence of 
hidden images. Interestingly, a version of VSS with innocent-looking images 
as shares can implement this steganography variant. In practice, however, 
both regular VSS and VSS with innocent-looking images work by expanding 
a single pixel of an image into multiple pixels, with consequences on image 
quality. It is indeed of great interest to design schemes achieving high image 
quality. Although the literature has paid a significant amount of attention to 
VSS, some different paradigms of VC have also been studied, giving rise to 
visual versions of other types of cryptographic protocols. 


1.1.2 Halftone Visual Cryptography 

Traditional VC constructions are exclusively based on combinational tech- 
niques. In the halftoning framework of VC, a secret binary image is en- 
crypted into high-quality halftone images, or halftone shares. In particular, 
this method applies the rich theory of blue noise halftoning to the construc- 
tion mechanism used in conventional VSS schemes to generate halftone shares, 
while the security properties are still maintained. The decoded secret image 
has uniform contrast. The halftone shares carry significant visual information 
to the reviewers, such as landscapes, buildings, etc. The visual quality ob- 
tained by the new method is significantly better than that attained by any 
available VSS method known to date. As a result, adversaries, inspecting a 
halftone share, are less likely to suspect that cryptographic information is 
hidden. A higher security level is thus achieved [26, 23]. 


1.1.3 Blue Noise Error Diffusion 


f(m,n) 



d(m,n) 


- h(k,l) - 
error filter 


e(m,n) 


+ 



t(m,n) 


FIGURE 1.1 

Block diagram for binary error diffusion. The pixel f{m. n) is passed through 
a quantizer to obtain the corresponding pixel of the halftone g(m,n). The 
difference between these two pixels is diffused to the neighboring pixels by 
means of the filter h(k,l). (Reprinted with permission from IEEE Trans. Inf. 
Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 ©IEEE 2009) 
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16 


x 



• 

7 

3 

5 

1 


FIGURE 1.2 

Floyd-Steinberg error filter. • indicates the current pixel. The weights are 
given by: h( 0, 1) = 7/16, h(l, —1) = 3/16, h(l,0) = 5/16 and h(l, 1) = 1/16. 
(Reprinted with permission from IEEE Trans. Inf. Forensics Security, vol. 4, 
no. 3, pp. 383-396, Sep. 2009 ©IEEE 2009). 


Among all blue noise halftoning algorithms, error diffusion is a simple, yet 
efficient algorithm to halftone a grayscale image. The quantization error at 
each pixel is filtered and fed back to a set of future input samples. Figure 1.1 
shows a binary error diffusion diagram where f(m, n) represents the (m, n)th 
pixel of the input grayscale image, d(m, n) is the sum of the input pixel value 
and the ’’diffused” past errors, and <7(771, n ) is the output quantized pixel value 
[12, 16]. Error diffusion consists of two main components. The first component 
is the thresholding block where the output g(m, n) is given by: 



if d(m, n) > t{m , n), 
otherwise. 


( 1 . 1 ) 


The threshold t(m,n) can be position-dependent. The second component is 
the error filter h(k. I ) whose input e(m, n) is the difference between d(m, n) 
and g(m, 77). Finally, we can compute d(m, n) as: 


d(m, n) — f(m , n) — k(k, 0 e ( m — k,n — l). (1.2) 

k,i 


As an example, the widely used Floyd-Steinberg error filter is shown in 
Figure 1.2 where • indicates the current pixel. The weights of the filter are 
given by: h( 0, 1) = 7/16, h(l, —1) = 3/16, /i(l,0) = 5/16 and ft(l, 1) = 1/16. 

The recursive structure of the block diagram shown in Figure 1.1 indicates 
that the quantization error e(m, n) depends not only on the current input and 
output but also on the entire past history. The error filter is designed in such a 
way that the low frequency difference between the input and output image is 
minimized. The error that is diffused away by the error filter is high frequency 
or ’’blue noise” in nature, leading to visually pleasing halftone images for 
human vision [12, 13, 7]. As will be described in this chapter, all the shares 
in the introduced halftone visual cryptography (HVC) methods are generated 
by a constrained error diffusion based on the algorithm introduced above. 

For the HVC construction methods to be introduced shortly, it is necessary 
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to generate mutually exclusive sets of pixels. To this end, the method of error 
diffusion is modified so as to produce multitone output pixels where the pixels 
of each tone are assigned to a pixel set. Multitone error diffusion is obtained 
by simply replacing the thresholding block by a multilevel quantization block 
in halftone error diffusion. The number of output levels of the quantization 
block is the same as the number of tones of the multitone image [15]. Multitone 
error diffusion can generate multitone images where the pixels of each tone are 
homogeneously distributed. The multitone error diffusion algorithm proposed 
in [4] is used here for the generation of mutually exclusive pixel sets. This 
algorithm jointly optimizes the distribution of multitone pixels by locating the 
pixels of different tones in a correlated fashion so that the mutual interference 
between different tones is minimized and multitone pixels are well separated 
from each other. Refer to [4] for details. 


1.2 Visual Secret Sharing 

We provide a brief description on visual cryptography where the key concepts 
will be referenced in subsequent sections. Please refer to [19, 2] for more details 
on VSS. 

1.2.1 Notion and Formal Definitions 

To illustrate the principles of VSS, consider a simple 2-out-of-2 VSS scheme 
shown in Figure 1.3. Each pixel p taken from a secret binary image is encoded 
into a pair of black and white subpixels in each of the two shares. If p is 
white/black, one of the first/last two columns tabulated under the white/black 
pixel in Figure 1.3 is selected. The selection is random such that each column 
is selected with a 50% probability. Then, the first two subpixels in that column 
are assigned to share 1 and the following two subpixels are assigned to share 
2. Independent of whether p is black or white, p is encoded into two subpixels 
of black-white or white-black with equal probabilities. Thus, an individual 
share gives no clue as to whether p is black or white [26, 25]. Now consider 
the superposition of the two shares as shown in the last row of Figure 1.3. 
If the pixel p is black, the superposition of the two shares outputs two black 
subpixels corresponding to a gray level 1. If p is white, it results in one white 
and one black subpixel, corresponding to a gray level 1/2. Then by stacking 
two shares together, we can obtain the full information of the secret image. 

Figure 3.24 shows an example of the application of the 2-out-of-2 VSS 
scheme. Figure 1.4(a) shows a secret binary image SI to be encoded. Ac- 
cording to the encoding rule shown in Figure 1.3, each pixel p of SI is split 
into two subpixels in each of the two shares, as shown in Figure 1.4(b) and 
Figure 1.4(c). Superimposing the two shares leads to the output secret im- 
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FIGURE 1.3 

In a 2-out-of-2 scheme, a secret pixel is encoded into 2 subpixels in each of 
the two shares. (Reprinted with permission from IEEE Trans. Inf. Forensics 
Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 ©IEEE 2009). 


age shown in Figure 1.4(d). The decoded image is clearly identified, although 
some contrast loss occurs. The width of the reconstructed image is twice that 
of the original secret image since each pixel is expanded to two subpixels in 
each share. 

The 2-out-of-2 VSS scheme demonstrated above is a special case of the 
fc-out-of-n VSS scheme [19]. Ateniese et al. designed a more general model for 
VSS schemes based on general access structures [2]. An access structure is a 
specification of all the qualified and forbidden subsets of shares. The partici- 
pants in a qualified subset can recover the secret image while the participants 
in a forbidden subset cannot. Formal definitions of VSS are presented below. 

Let V = (1, • • • , n} be a set of elements called participants. A visual secret 
sharing scheme for a set V of n participants is a method to encode a secret 
binary image SI into n shadow images called shares, where each participant 
in V receives one share. Let 2 P denote the set of all subsets of V and let 
L Quai Q 2 P and T Fork Q 2 P , where TQ ua ; O T Forb = 0- We refer to members 
°f r Quaf as qualified sets and call members of T Fork forbidden sets. The pair 
(rQuai, r Forb) is called the access structure of the scheme [2]. 

Any qualified set of participants X £ Tq ua ; can visually decode SI, but 
a forbidden set of participants Y £ Tf-orfe has no information of SI [2, 3]. A 
visual recovery for a set X £ VQ ua i consists of xeroxing the shares given to 
the participants in X onto transparencies and then stacking them together. 
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(c) Share 2 (d) Decoded image 

FIGURE 1.4 

Example of 2-out-of-2 scheme. The secret image (a) is encoded into two shares 
(b)-(c) showing random patterns. The decoded image (d) shows the secret 
image with 50% contrast loss. (Reprinted with permission from IEEE Trans. 
Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 ©IEEE 2009). 

The participants in X are able to observe the secret image without perform- 
ing any cryptographic computation. VSS is characterized by two parameters: 
the pixels expansion 7, which is the number of subpixels on each share that 
each pixel of the secret image is encoded into, and the contrast a, which is 
the measurement of the difference of a black pixel and a white pixel in the 
reconstructed image [5]. 

For each secret binary pixel p that is encoded into 7 subpixels in each of 
the n shares, these subpixels can be described as an n x 7 Boolean matrix M, 
where a value 0 corresponds to a white subpixel and a value 1 corresponds 
to a black subpixel. The itli row of M, 17, contains the subpixel values to 
be assigned to the ith share. The gray level of the reconstructed pixel p , 
obtained by superimposing the transparencies in a participant subset X = 
>*s}> is proportional to the Hamming weight w(v) of the vector 
v = OR(y , r j 2 , • • • , r .7 ) , where r ix , r , 2 , • • • , r j s are the corresponding rows in 
the matrix M [26, 25]. 

Definition 1 Let (Tq uci i , Tport) be an access structure on a set of n par- 
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ticipants. Two collections of n x 7 Boolean matrices C 0 and C± constitute a 
VSS scheme if there exists a value a( 7) and value tx for every X in Tq uci i 
satisfying [3]: 

1. Contrast condition: any (qualified) subsetX = {ii,i2,--- ffu} G 
r Q. U ai of u participants can recover the secret image by stacking the 
corresponding transparencies. Formally, for a matrix M £ Cj, (j = 
0,1^ the row vectors Vj(X, M) = OR(ri 1 , r i 2 , • • • , rj u ). It holds that: 
w(y o(X, M)) <tx~ <2(7) • 7 for all M £ Co and ty(vi(X, M)) > tx 
for all M £ Ci. a( 7) is called the relative difference referred to as 
the contrast of the decoded image and tx is the threshold to visually 
interpret the reconstructed pixel as black or white. 

2. Security condition: Any (forbidden) subset X = {i\, *2, • ' ' > b>} € 
r Forb has no information of the secret image. Formally, the two col- 
lections T)j(j = 0 , 1 ), obtained by extracting rows i\, «2, • • • ,i v from 
each matrix in Cj, are indistinguishable. 


1.2.2 Construction of VSS Scheme 

If the given secret pixel p is black (white), the matrix M is randomly selected 
from matrices collections C\ (Co). The matrix collections can be obtained by 
permuting the columns of the corresponding basis matrix So or Si in all 
possible ways [ 3 ]. The basis matrices are defined below. 

Definition 2 Two matrices So and Si are called basis matrices, if So and Si 
satisfy the following tow conditions [3]: 

1. Contrast condition: If X = {ii,Z2,--- , i u } £ Tq uo ;, the row 
vectors Vo and Vi, obtained by performing OR operation on rows 
ii, *2, • • • ,i u of S 0 and Si respectively, satisfy w(v 0 ) < tx — 0(7) ■ 7 
and w(v 1) > tx- 

2. Security condition: If X = {ii , *2 5 ■ • • , i v } G Vporb . one of 
the two v x 7 matrices, formed respectively by extracting rows 
*1 5 *2 5 • • • ffv ffom So and Si, equals to a column permutation of 
the other. 


The algorithm to construct the basis matrices for a given VSS scheme can 
be found in [ 2 , 5 ]. See [ 5 ] for the construction algorithm of basis matrices 
that leads to the best contrast. As an example, the So and Si in a 2 -out-of -2 
scheme are shown below: 


S 0 = 


0 1 
0 1 ’ 


Si 


0 1 
1 0 


( 1 . 3 ) 


So corresponds to the encoding of a white secret pixel and Si corresponds to 
the encoding of a black secret pixel. 
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1.3 Halftone VSS Construction Using Error Diffusion 

The introduced methods for halftone VSS are built upon the fundamental 
principles of conventional VSS. Given a secret halftone image and multi- 
ple grayscale images, halftone shares are generated such that the resultant 
halftone shares are no longer random patterns, but take meaningful visual 
images. Without loss of generality, the /c-out-of-n scheme is described in the 
following. 


1.3.1 Share Structure 

The first step in constructing a halftone VSS scheme is to construct the un- 
derlying fc-out-of-n VSS scheme where a secret image pixel is encoded into 7 
pixels in each share. 7 is the VSS pixel expansion and only a function of (&, n). 
Furthermore, in halftone VSS, a share image is divided into nonoverlapping 
halftone cells of size q = v\ x V 2 where q > 7. A secret image pixel is encoded 
into one halftone cell in each share. Within the q pixels in a halftone cell, 
only 7 pixels called secret information pixels (SIPs) actually carry the secret 
information. Here 7 is exactly the VSS pixel expansion. Since 7 SIPs are not 
designed to carry share visual information, <7 > 27 is desirable for good share 
image quality. 

It is required that when all qualified shares are stacked together, only the 
secret visual information is revealed. Thus, besides SIPs, auxiliary pixels that 
are forced to be black (value 1) are also introduced. These pixels are called 
auxiliary black pixels (ABP). In each halftone cell, there are x ABPs. ABPs 
are deliberately introduced into the shares so that some ABPs on one share 
block the visual information of the other shares. Thus, when qualified shares 
are stacked together, only the secret visual information is revealed on the 
reconstructed image as a result of the OR operation. In each halftone cell, the 
remaining q — 7 — x pixels that are neither SIPs or ABPs are assigned to carry 
the visual information of the shares. 

An example of the halftone cells in a 2-out-of-2 scheme is shown in Fig- 
ure 1.5 where the 1st and 2nd pixels in each cell are SIPs. The 3rd pixel in 
share 1 and the 4th pixel in share 2 are ABPs. When stacking two shares to- 
gether, the result is a white pixel with contrast 1/4. The 4th pixel in share 1 
and the 3rd pixel in share 2 are assigned values to carry visual information of 
the shares. They can take a value of 0 or 1, which will not affect the decoded 
image. 

There should be a sufficient number of ABPs in the shares so that the 
visual information of one share is completely blocked by the ABPs on the 
other shares. Since the ABPs are not designed to carry visual information, 
the number of ABPs in a share is to be minimized as follows. Let p (i,j) = 
[pi(i, j), ■ • ■ ,Pn(i,j)] T be the vector where pi{ij) is the (i,j) th pixel 
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share 1 


share 2 


decoded 


FIGURE 1.5 

Example of halftone cells in a 2-out-of-2 scheme using the first method. The 
1st and the 2nd pixels in both shares are SIPs. The 3rd pixel in share 1 and 
the 4th pixel in share 2 are ABPs. Others (”X”) are assigned to carry vi- 
sual information. (Reprinted with permission from IEEE Trans. Inf. Forensics 
Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 ©IEEE 2009). 


of share l. If the (i, j)th pixel is non-SIP, there should be at least n — k + 1 
ABPs in p (i,j) so that any k entries selected from p (i,j) contain at least 
one ABP. In each halftone cell, there are q — 7 non-SIPs. Thus, the optimal 
number of ABPs in a halftone cell is: 

J *°r n ~^ +1 ( g-7)i, (i-4) 


where [ ] returns the smallest integer that is no less than the argument. 

To understand how the x ABPs are arranged in a halftone cell, we intro- 
duce a configuration matrix T to describe the <7 — 7 non-SIPs. In the matrix 
T, only the values of ABPs are defined. In a fc-out-of-n scheme, T is of size 
(q— 7) x n where one row corresponds to one share. There are x ABPs assigned 
to each row. The ABPs in each row should have minimal overlap with ABPs 
on the other rows. The construction of the matrix T is as follows. First, x 
ABPs are placed on the first row from the first to xth column. Then another 
x ABPs are placed on the second row from the {x + l)th column to the (2x)th 
column. If 2a: > q — 7, then the ABPs are placed from the (£ + l)th column to 
the last column and then from the first column to the (2x — q + 7)th column. 
The x ABPs on other rows are placed sequentially in the same way. 

For the 2-out-of-2 example above, the configuration matrix T for the 2 
non-SIPs is: 


1 

A 1 ’ 


(1.5) 


where 1 indicates ABP that has value 1 and A indicates an undefined pixel. 
The corresponding non-SIPs are then assigned values to carry the share visual 
information through the error diffusion. Each row of T is assigned to each 
share. It can be seen that when we stack 2 halftone shares together, all the 
non-SIPs result in black. 
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As another example, consider a 2-out-of-3 halftone VSS scheme where a 
secret image pixel is encoded into a halftone cell of size q = 12. The number 
of SIPs is 7 = 6. By Eqn. 1.4, the optimal number of ABPs is x = 4. Thus, 
the configuration matrix T of the 6 non-SIPs is given by: 


T = 


1 1 1 1 A A 
1 1 A A 1 1 
A A 1 1 1 1 


( 1 . 6 ) 


From the content of T, it is concluded that 1/3 of the pixels on a share will 
be ABPs. 


1.3.2 Distribution of SIPs and ABPs 

The locations of the SIPs do not depend on the share images or the secret im- 
age, but only on the HVC expansion q and the underlying VSS scheme. Thus, 
the distribution of SIPs can be generated prior to the generation of halftone 
shares. For security purposes, the SIPs should be randomly distributed. To 
achieve good image quality, it is also desirable to distribute the SIPs homo- 
geneously so that one SIP is maximally separated from its neighboring SIPs. 
Since the SIPs are maximally separated, the quantization error caused by an 
SIP will be diffused away before the next SIP is encountered leading to visu- 
ally pleasing halftone shares. Similarly, the distribution of ABPs can also be 
determined a priori. As SIPs, ABPs should be distributed as homogenously 
as possible and maximally separated from each other. Since there is a strong 
correlation between the distribution of SIPs and the distribution of ABPs, the 
distributions of SIPs and ABPs should be optimized jointly to avoid low fre- 
quency spectral interference among them [4] . The SIPs and ABPs should also 
be maximally separated from each other. The jointly optimized distributions 
of SIPs and ABPs are generated based on a method of blue noise multitoning 
as follows [4]. 

We first construct a constant grayscale image with gray level g = 
X/;=o Qi z i> where gi is a tone arbitrarily chosen between 0 and 1 and g t gj 
for i ^ j. Zi is the pixel density for the pixels with tone g,;. The value of Zi, 
together with w, depends on q, 7 and the structure of the configuration matrix 
T. By using the blue noise multitone error diffusion, an output image with 
w+1 tones is produced. The distribution of pixels with tone g t indicates a pixel 
distribution denoted by Zi. Let Zq = 7 / q , then Z 0 indicates the distribution 
of SIPs. The distribution of ABPs in a share is a subset of {Zi}, i = 1, . „ . , w. 

An example following the previous 2-out-of-3 halftone VSS example is used 
to illustrate how to set Z{, gt, and w, where a secret image pixel is encoded 
into a halftone cell of size q = 12. Among the q pixels, 7 = 6 SIPs are 
characterized by basis matrix S 0 or Si; q — 7 = 6 non-SIPs are characterized 
by the configuration matrix T. Thus, the matrix R,, , i = 0,1, is constructed 
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below for the q pixels: 


Ri 


[Si T] 

’□□□□□□ 1 1 1 1 A A " 

□ □□□□□AA 1 1 1 1 

□ □□□□□11AA11 ’ 


Zo 



(1.7) 


where each row corresponds to q pixels in one share. The □ indicates the SIPs 
that are determined by S,;. Columns of R; are partitioned into several sets Z,, 
where the columns with the same configuration are assigned to the same set. 
As shown in (1.7), columns are partitioned into 4 sets Z it i = 0,1, . . . ,3. The 
set Zo denotes the distribution of SIPs and contains 1/2 of all the pixels. The 
non-SIPs of each share are partitioned between set Z\, Z i, and Z 3, where each 
set contains 1/6 of all the pixels. Thus, to generate Z,; on the share, we can set 
the parameters for the multitone error diffusion as follows: w = 3, zq = 0.5, 
and z\ = Z 2 = z 3 = 1/6. The corresponding tone is arbitrarily chosen as: 
go = 0, g\ = 0.3, <72 = 0.6, and g 3 = 0.9. By using the algorithm proposed in 
[4], we obtain homogenous distributions Zi, i = 0, 1, . . . , 3. The combination 
of Z\ and Z 2 is the distribution of ABPs of share 1; the combination of Zi 
and Z 3 is the distribution of ABPs of share 2; and the combination of Z\ and 
Z 3 is the distribution of ABPs of share 3, as shown in (1.8) 


{ SIPs of all shares 
ABPs of share 1 
ABPs of share 2 
ABPs of share 3 


^0 

Z\ U Zi 
Zi U Z3 
Z\ U Z 3 . 


(1.8) 


As an example, assume the share has size 6x8 and is partitioned into 
4 halftone cells of size 3x4, each cell corresponding to one secret image 
pixel. Within each cell, there are 6 SIPs and 4 ABPs. Suppose the generated 
distributions Z,, i = 0, 1, . . . , 3 are shown on the up-left image in Figure 1.6. 
Then, as also shown in Figure 1.6, the distributions of SIPs and ABPs of each 
share are determined based on Zi. Note that without knowing what values the 
As carry, any two shares can be stacked together to decode the secret image 
pixels. 

Notice that we may not be able to generate an exact number of pixels as 
desired for sets Z, : , * = 0,1, 2, 3. However, for ABPs, as long as the membership 
of ABPs to the sets Zi indicated in (1.8) is maintained, a slight deviation 
from its desired number of pixels for Zi, i = 1, 2, 3 is allowable. The contrast 
condition of image decoding is still maintained. Such a point can be clearly 
illustrated in Figure 1.7 where the composition of each share is shown. It is 
clear that the relative size of Zj, * = 1, 2, 3 is not important. 

However, the distribution of SIPs, denoted by Z 0 , needs to be refined to 
guarantee that there are exactly 7 SIPs in each halftone cell. Each halftone 
cell is checked to find out the number of pixels belonging to Zq. Assume the 
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FIGURE 1.6 

Upper left: distributions Z,, i = 0, 1,...,3. □ indicates pixels within Zq; •, 
indicates pixels within Z l . Upper right: distribution of SIPs and ABPs in 
share 1. Down left: distribution of SIPs and ABPs in share 2. Down right: 
distribution of SIPs and ABPs in share 3. •, indicates ABP and A indicates 
pixels used to carry share visual information. (Reprinted with permission from 
IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 
©IEEE 2009). 


number is r. In most cases, r = 7 and no operation is needed. If r < 7 , then 
7 — t pixels within the current cell are selected and removed from sets Z,, 

0 and assigned to Zq. The pixels are added one by one in such a way that 
each newly added pixel is maximally separated from other pixels belonging to 
Zq within that halftone cell. If r > 7 , then within that halftone cell, 7 — r 
pixels belonging to Zq are randomly selected and removed from Zq. For each 
removed pixel, a pixel set is randomly selected from {Z,}, i 0 and the 
removed pixel is added to that set. After such a procedure, there are exactly 
7 SIPs in each halftone cell and most of the SIPs are well separated from each 
other. 

The configuration matrix helps to generate the distribution of ABPs. It 
should be noted that there is no need to find out the exact x ABPs in each 
halftone cell. The number x only characterizes the local density of the ABPs. 
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FIGURE 1.7 

Composition of shares. □ indicates SIPs; 1 indicates ABPs; A indicates pixels 
to carry the share visual information. (Reprinted with permission from IEEE 
Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 ©IEEE 
2009). 


We also only need to ensure that the contrast condition of the image decoding 
is satisfied. 

1.3.3 Generation of Halftone Shares via Error Diffusion 

After the distributions of SIPs and ABPs are generated, the next step is 
to assign the values to all the SIPs. This procedure only depends on the 
underlying VSS scheme. Under the fc-out-of-n VSS scheme, the basis matrices 
So and Si are constructed first. Then we construct the matrix collections Co 
and Ci from the basis matrices. For each 7 SIPs of a halftone cell, a matrix M 
is randomly selected from Co or Ci depending on the value of the corresponding 
secret image pixel p. The SIPs in the zth share are then replaced with the ith 
row of M. Sij, the j'th SIP in share i, is set as: s tJ = M(i, j). For the ABPs, 
they are assigned value 1 (black). Thus, the locations and the values of the 
SIPs and ABPs are set before halftone shares are actually generated. As it 
will be described below, the pixels other than ABPs and SIPs are assigned 
freely to carry the share visual information. 

Once the assignments of the SIPs and ABPs are determined, a halftoning 
algorithm, such as error diffusion and direct binary search (DBS) [1], can be 
employed to produce the halftone shares from grayscale images. Error diffusion 
is used in our method as it is a computationally efficient way to generate 
halftone shares. The basic computation required is linear filtering followed by 
quantization. 

The process of generating halftone shares via error diffusion is shown in 
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FIGURE 1.8 

Block diagram of halftone VSS using the first method. Depending on the se- 
cret image and VSS scheme chosen, the SIP assignment block outputs the 
SIPs. If < 7 ,(m , n) is a SIP or ABP, its value is prefixed. Otherwise, gi(m, n) is 
determined by the output of the thresholding block. (Reprinted with permis- 
sion from IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 
2009 ©IEEE 2009). 


Figure 1.8, w'here the values of the SIPs and ABPs are preset. To produce the 
halftone share i, a grayscale image is provided. Let fi(m,n) be the (m, n)th 
pixel of the grayscale image, then the input to the threshold block is: 

di(m, n) = fi(m, n) — a h(k, l)ei(m — k,n — l), (1-9) 

k,l 

where h(k, l) £ H and H is a two dimensional error filter. Here 0 < a < 1 is an 
error diffusion constant that can be timed to avoid instability in error diffusion 
[24]. A a < 1 means that not all quantization errors are diffused, which 
can prevent instability under excessive quantization errors. ei(m, n) is the 
quantization error at point ( m,n ). Assume the threshold for the error diffusion 
is t;(m, 77.), then the output halftone pixel 9 ,( 777 ,, n) is 1, if d,(m, n) > ti(rra, n)\ 
or 0, if di(m,n) < ti(m,n). The quantization error e;(m. n) is given by: 

ei(i,j) = gi(m,n)-di(m,n). (1.10) 

The above procedure is applied only when gi(m,n) is not a SIP or an 
ABP. Otherwise, instead of simple thresholding, the value of the output pixel 
gi(m,m) is set equal to the value of the corresponding predetermined SIP 
or ABP and the error ef(m, n) is calculated as the difference between the 
input to the thresholding block and the SIP or ABP value. Since the SIPs 
and ABPs are separated from each other, the quantization error caused by 
the introduction of the SIPs and ABPs is diffused away to the neighboring 
grayscale pixels, as illustrated in Figure 1.8, and will not accumulate to cause 
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visible distortion. In this way, the SIPs and ABPs are seamlessly embedded 
into the halftone shares generated and the halftone share is structured taking 
meaningful visual information. 

Much like the methods in [26, 25], the above procedure can be extended 
to an arbitrary access structure (Tq^^T Forb)- The security of the introduced 
halftone VSS scheme is guaranteed by the properties of the underlying visual 
secret sharing scheme. 


1.4 Halftone VSS Construction Using Parallel Error 
Diffusion 

In the previous method, uniformly distributed auxiliary black pixels are intro- 
duced to satisfy the contrast condition of image decoding. The current method 
exploits the fact that halftoning of the grayscale images alone may generate a 
sufficient number of black pixels to block the shared visual information from 
showing on the decoded image. 

As in the previous method, in the current method, the shares are also di- 
vided into non over lapping halftone cells of size q = Vi x V 2 - 7 pixels within 
the halftone cell are SIPs carrying the secret visual information. A method 
based on error diffusion is used to generate the distribution of SIPs. To this 
end, a const ant- value grayscale image of gray level zq = 7 /q, having the same 
size of a share image is first produced. This grayscale image is then halftoned, 
producing a distribution of ”l”s, denoted by Zq- Zq determines the distri- 
bution of the SIPs. To ensure that there are exactly 7 ”l”s in each halftone 
cell, the error diffusion is constrained such that the values of some pixels are 
preset and are not modified by the error diffusion. The error e(m, n), which is 
the difference between the input to the thresholding block and the resultant 
pixel value, is still calculated for the preset pixels and then diffused away to 
neighboring grayscale pixels through the error filter. In this constrained er- 
ror diffusion mechanism, if the current halftone cell already contains 7 ”l”s, 
the rest of the pixels in the halftone cell are prefixed and constrained to be 
”0”s. The quantization error is accumulated and diffused to grayscale pixels 
in neighboring cells. If the current halftone cell contains t < 7 ”l”s, and the 
error diffusion already proceeds to the (q — 7 — t)th pixel of the current cell, 
then the rest of the 7 — t pixels in that cell are all constrained to be ”l”s. This 
procedure guarantees that there are exactly 7 SIPs in each halftone cell. Since 
the errors are always diffused to neighboring grayscale pixels, a homogeneous 
distribution of SIPs is produced, where most of the SIPs are well separated 
from each other. The assignment of SIPs are predetermined using the same 
approach as described previously. 

Then, the current method halftones the grayscale images in parallel to 
produce the halftone shares. Within the error diffusion process, all the shares 
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are checked at each non-SIP position to see if a sufficient number of black 
pixels have been produced. If a sufficient number of black pixels have not yet 
been generated, black pixels are deliberately inserted at that position. The 
SIPs are again preserved and not changed. 

In a fc-out-of-n scheme, if only r < n — k + 1 black pixels are generated 
by halftoning at a non-SIP location (■ i,j ), then A = n — k + 1 — r shares 
with the smallest magnitudes of halftone error at (i,j) are selected and black 
pixels are inserted at (i. j) on these shares. Thus, the contrast condition of 
image decoding is guaranteed. The quantization error caused by the inserted 
black pixels will be diffused away to neighboring grayscale pixels and pleasing 
halftone shares can be obtained. Since far fewer black pixels are deliberately 
introduced, the second method imposes fewer constrains on the error diffusion 
and thus it has the potential to achieve better image quality than that of the 
first method. However, to achieve uniform image quality of the whole share, 
we need to choose the grayscale images in a selective way. 

It is clear that the decision to insert a black pixel or not depends on the 
image content of the shares. Thus, the inserted black pixels are not evenly 
distributed. In some regions of the image, the error diffusion mechanism is 
constrained by the SIPs. In some other regions, error diffusion is constrained 
not only by the SIPs but also by the inserted black pixels. Therefore, the im- 
age quality on some regions in the image may be better than the image quality 
on some other regions that exhibit more artifacts. The parallel approach may 
thus generate shares whose image quality is not consistent over the whole im- 
age. Such quality discrepancy may cause visible distortions. To mitigate such 
visible distortion, we need to minimize the number of black pixels inserted. 
An obvious way to mitigate the distortion is to select grayscale images where 
the contents of some images tend to be complimentary to those of the others. 
For example, if there is one bright (white) region on one image, there should 
be corresponding dark region(s) in some other image(s). Then the halftoning 
of the grayscale images will generate most of the black pixels needed and the 
number of inserted black pixels will be greatly reduced, which leads to visually 
pleasing halftone shares. In a n-out-of-n scheme, if n 1, then this approach 
is especially effective and the visible distortion is less likely to happen. 


1.5 Quality of Halftone Shares 

In this section, we focus on the quality analysis of the halftone shares for the 
first method. The analysis also helps to evaluate the share image quality of the 
second method. With the exception of the SIPs and the ABPs, all pixels in the 
halftone share produced by the first method are assigned freely to carry the 
shared visual information. The proportion of these pixels governs the image 
quality of the resultant halftone shares. The quantity s is called the quality 
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index of the halftone share and is represented as: 


s = 


q — x — 7 

q 


( 1 . 11 ) 


where q is the halftone cell size, x is the number of ABPs in a cell, and 7 is the 
number of SIPs in a cell. A large s leads to good image quality of the halftone 
share. However, s cannot be arbitrarily large and it can be shown that: 


n q 


Thus, the best image quality of a halftone share that can be achieved depends 
on k, n and the halftone cell size q. If k, n, and s are the design parameters, 


then q is calculated as: 


Q = 


r ( k - ^7 

k — ns — 1 


(1.13) 


Consider the 2-out-of-2 scheme. Assume q = 4, then it is calculated that 
x = 1 and s = 0.25. Since s is small, the image quality of the share is not 
high. If q is larger, then better image quality can be expected. Furthermore, 
as q — > 00 , s approaches 0.5. However, a larger q leads to worse contrast loss 
of the reconstructed image. As will be shown later, the contrast loss of the 
reconstructed image can be improved by filtering. 

The quality of each share depends on the quality index s. We can compare 
the share image with the halftone image generated from the grayscale image 
without encoding any secret information and then compute the perceived 
error e between the coded and uncoded halftone image. The perceived error is 
calculated by employing an appropriate human visual system (HVS) model. 
See [11, 9] for details. 

For the second method, it is difficult to determine the proportion of pixels 
that carry visual information of the shares. However, it is clear that for n 1 
in a n-of-of-n scheme, the quantity s approaches: 


q - 7 

q 


(1.14) 


which indicates potentially good image quality for a sufficiently large q. 

Compared with methods in [26] and [22], the requirement of a comple- 
mentary pair is removed and all shares generated carry natural images. From 
( 1 . 12 ), it is clear that for the first method, the quality index is more correlated 
to {k,n} in the VSS scheme. A visually pleasing halftone image share can be 
obtained if n 1 and n — k is small, and if the HVC expansion q is suffi- 
ciently large. If small image quality discrepancy of the share is tolerable, then 
we should first consider the first method, especially if we have the flexibility 
to choose the grayscale images. If the grayscale images are carefully chosen, 
n 1 , and n — fc is small, then the distortion due to image quality discrep- 
ancy will be hardly noticeable. Otherwise, only the first method should be 
considered since it is the only method that guarantees uniform image quality 
of the shares without using complimentary shares. 
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1.6 Discussion 

1.6.1 Improvement of Image Quality 

As stated previously, the quality index s heavily affects the image quality of the 
halftone shares. A large s leads to visually pleasing halftone shares, but it also 
introduces higher contrast loss in the reconstructed images. The error filter 
employed in the error diffusion also affects the image quality of the shares. For 
example, an error filter with longer weights leads to a sharper contrast in the 
halftone image [20, 14]. Another factor that affects the image quality is the 
position-dependent threshold in the thresholding block. To achieve a visually 
more pleasing halftone image, output-dependent threshold modulation can be 
used in the error diffusion to spread the minority pixels as homogeneously as 
possible and suppress some unwanted textures [6]. For various methods that 
can improve the halftone image by error diffusion, refer to [20, 6, 17, 21], etc. 

Error diffusion is employed as the halftoning algorithm to generate halftone 
shares since error diffusion is able to generate a visually pleasing halftone 
image with simple computation. However, other halftoning algorithms can 
also be applied to the second method to generate halftone shares. The DBS 
algorithm can be used to generate a high quality halftone image but with 
significant computation [1] . Note that the DBS algorithm for multitoning can 
also be used to generate the distributions of SIPs and ABPs. 

1.6.2 Comparison with Other Methods 

To evaluate the performance of the introduced methods, it is illustrative to 
compare our methods with VC and extended visual cryptography (EVC) [3]. 
VSS can be treated as a special case in our methods for s = 0, which means 
that no visual information is carried by the share. In EVC, shares carry visual 
information and there is a tradeoff between the contrast of the reconstructed 
image and the contrast of the share image. This tradeoff is similar to the 
tradeoff between the contrast of the reconstructed image and the image quality 
of the halftone shares in our methods. However, the shares generated by EVC 
is basically based on pixels expansion. Thus, EVC is unable to generate shares 
that can show fine details. 

1.6.3 Image Decoding 

In the methods introduced in this chapter, a large HVC expansion is desirable 
to make s large. But the contrast loss of the decoded image is severe when the 
HVC expansion is large. However, a low contrast does not hinder the decoding 
of the secret image if the decoding can be performed digitally. Initially shares 
are supposed to be xeroxed on transparencies and decoding of the secret image 
involves stacking the shares physically. However, both the distribution of the 
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shares and decoding of the secret image can be performed in a digital way 
where the decoding rule remains the same (OR operation). The human visual 
system is still the ultimate tool to identify the secret image. 

The robustness of the introduced scheme to the contrast loss is attributed 
to the fact that shares have well-defined local structure. If decoded digitally, 
we can measure the local intensity of the reconstructed image by filtering 
the data through a running window. Then we measure the local intensity of 
the data within the window. We can assign 1 to the current pixel if the local 
intensity is relatively high and assign 0 to the current pixel if the local intensity 
is relatively low. By such a simple method, the contrast of the reconstructed 
image can be enhanced and the content is more readable. The size of the 
running window should be the same as the size of the halftone cell. However, 
if the halftone cell size is unknown, a proper window size can be obtained by 
trying different window sizes until only two different local intensities are most 
likely to appear. 


1.7 Simulation Results 



(a) 


(b) 


FIGURE 1.9 

(a) Grayscale image Lena, (b) Part of the distribution of SIPs and ABPs. 
The gray pixels indicate SIPs and the black pixels indicate ABPs. (Reprinted 
with permission from IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 
383-396, Sep. 2009 ©IEEE 2009). 
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In this section, examples are provided to illustrate the effectiveness and 
tradeoff of the introduced methods. Constructions of 3-out-of-3 halftone VSS 
schemes are illustrated. The secret image to be encoded is the logo of the 
University of Delaware. Three grayscale natural images, Lena, Earth, and 
Baboon are provided to generate the shares. The size of the share is 513 x 513 
and the size of the secret image is 171 x 171. For illustrative purposes, image 
Lena is shown in Figure 1.9(a). 

The VSS pixel expansion of the secret pixel is 7 = 4 and the size of the 
halftone cell is q = 3 x 3. The number of ABPs for each halftone cell is x = 2 
and the quality index is s = 1/3. The distributions of SIPs and ABPs for each 
share are decided before halftone shares are generated. The jointly optimized 
distribution of SIPs and ABPs over a local region in one share is shown in 
Figure 1.9(b) where the gray pixels indicate SIPs and the black pixels indicate 
ABPs. We use the Floyd-Steinberg error filter shown in Figure 1.2 for the error 
diffusion. For robust error diffusion, output-dependent threshold modulation 
is employed and the threshold t{m, n) at the point (m, n ) is given by: 

t(m, n) = 0.25 + 0.33 x 0.25 x [g(m, n — 1) 

+ g(m, n — 2) + g(m, n — 3)] . 

The threshold modulation tries to adjust the current threshold by using the 
information of three preceding halftone pixels. For error diffusion, the error 
diffusion constant is set to a = 0.8 to avoid error diffusion instability. 

Three output shares are shown in Figure 1.10(a) to Figure 1.10(c), re- 
spectively, where the corresponding perceived errors are also shown. When 
calculating the perceived error e, an alpha stable human visual system model 
proposed in [9] is used. All shares show visually pleasing halftone images where 
the image details can be clearly recognized. The resultant shares do not show 
either residue image of the encoded image or any residue image of other shares. 
Figure 1.10(d) shows the reconstructed image when shares 1 to 3 are ’’stacked” 
together with the OR operation. The content of the reconstructed image is 
clearly recognizable with a contrast a = 1/9. The decoded image does not 
bear any residue of any share images. 

To illustrate the tradeoff between the share image quality and contrast of 
the decoded image, we show another set of simulation results of a 3-out-of-3 
halftone VSS scheme. Compared with the previous example, the halftone cell 
size is changed to q = 4 x 4. The sizes of the shared image and the secret image 
are well adjusted to be 512 x 512 and 128 x 128, respectively. The number of 
ABPs for each halftone cell is x = 4 and the quality index increases to s = 1/2. 
The three output shares are shown in Figure 1.11(a) to Figure 1.11(c), respec- 
tively, where the corresponding perceived error is also shown. Figure 1.11(d) 
shows the reconstructed image by stacking three shares together, where the 
contrast of the decoded image is a = 1/16. Shares in the second example have 
larger halftone cell size, thus larger s and better image quality than that of 
the shares in the first example, as can be seen from Figure 1.11. However, the 
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(c) (d) 


FIGURE 1.10 

(a)-(c) Shares of the 3-out-of-3 scheme using the first method, <7 = 9. The 
perceived errors are 1.73 x 10 10 , 8.45 x 10 9 , and 5.46 x 10 9 , respectively, (d) 
Decoded image by shares (a)-(c), a = 1/9. (Reprinted with permission from 
IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 
©IEEE 2009). 
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(c) (d) 


FIGURE 1.11 

(a)-(c) Shares of the 3-out-of-3 scheme using the first method, q = 16. The 
perceived errors are 7.1 x 10 9 , 3.48 x 10 9 , and 2.27 x 10 9 , respectively, (d) 
Decoded image by shares (a)-(c), a. = 1/16. (Reprinted with permission from 
IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 
©IEEE 2009). 
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contrast loss of the decoded image is worse. It is observed that the contrast 
of Figure 1.11(d) is lower than that of Figure 1.10(d). 



(c) 


(d) 


FIGURE 1.12 

(a)-(c) Shares of the 3-out-of-3 scheme using the second method, q = 16. 
(d) Decoded image by shares (a)-(c), a = 1/16. (Reprinted with permission 
from IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383-396. Sep. 2009 
©IEEE 2009). 

In the following, we present the halftone shares generated by using the 
second construction method. The performance of the second method is evalu- 
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(a) 


(b) 



(c) 


FIGURE 1.13 

(a)-(c) Another set of shares generated by the second method, q = 16, depict- 
ing more pronounced artifacts. (Reprinted with permission from IEEE Trans. 
Inf. Forensics Security, vol. 4, no. 3, pp. 383-396, Sep. 2009 ©IEEE 2009). 
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ated by comparing its shares with those of the first method. Figure 1.12(a)-(c) 
show three shares produced using the second method in a 3-out-of-3 scheme 
where the size of the image is 512 x 512 and the size of the halftone cell is 4 x 4. 
Here, images Lena , Tank , and Baboon are used. It is obvious that all halftone 
shares show images with fine details. The reconstructed image is shown in Fig- 
ure 1.12(d), which preserves all the secret information. Compared with Figure 
1.12(a), Figure 1.11(a) is generated using the first method, showing less image 
details and appearing dark due to the added ABPs. 

We should point out that the second method does not necessarily pro- 
duce visually pleasing halftone shares if the grayscale images are not carefully 
selected. As an example, Figure 1.13(a)-(c) shows another set of shares gen- 
erated by Lena , Earth , and Baboon using the second method with the same 
scheme. Careful inspection shows these shares present more artifacts due to 
the cross interference between the shares. The reason is that the contents of 
the three grayscale images are not complementary to each other. Comparing 
Figure 1.13(a) with Figure 1.11(a) and Figure 1.12(a), local geometric distor- 
tion can be observed in Figure 1.13(a). The texture of the distorted region 
is quite different from that of the neighboring regions, which causes visible 
artifacts. On the other hand, Figure 1.11(a) and Figure 1.12(a) both show 
smooth images with uniform image quality. Thus, it is important to choose 
appropriate grayscale images for the second method. 


1.8 Conclusion 

In this chapter, HVC construction methods based on error diffusion are in- 
troduced, which can generate shares with pleasing visual information. In the 
introduced methods, the pixels that carry the secret information are preset 
before a halftone share is generated from a grayscale image. Error diffusion is 
used to construct the shares so that the noise introduced by the preset pixels 
is diffused away when halftone shares are generated. The secret information 
is then naturally embedded into the halftone shares. The homogeneous and 
isotropic distribution of the preset pixels imposes the least noise in the er- 
ror diffusion, thus leading to shares with high image quality. Our introduced 
methods follow the basic principle of VC, thus the security of the construction 
scheme is guaranteed. The introduced HVC constructions apply not only to 
VSS but also to VSS used in the context of visual authentication and encryp- 
tion. 

For the first method, by using auxiliary black pixels, the contrast condition 
of the decoded image is satisfied. Furthermore, the shares do not suffer any 
interference from other shares. When auxiliary black pixels are employed, blue 
noise multitone error diffusion is used to generate the distributions of the secret 
information pixels and black auxiliary pixels. The second method exploits the 
fact that halftoning of the graycale images alone can generate most of the black 
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pixels needed. Black pixels are inserted only when a sufficient number of black 
pixels have not yet been produced. By carefully selecting the grayscale images, 
the second method can also generate shares with visually pleasing images. For 
both methods, the decoded image does not suffer any interference from the 
shared images. It is clear that there is a tradeoff between the shared image 
quality and the contrast loss of the decoded image. However, by simple linear 
filtering, the contrast loss can be easily recovered. 
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2.1 Introduction 

The key property used to construct visual cryptography schemes for black 
and white images is the following: if we superpose transparencies with black 
and white pixels, the resulting pixel that our eyes see is black if at least one 
of the superposed pixels is black and is white if all the superposed pixels are 
white. Such a property can be rephrased as follows: the possible ’’state” for 
the pixels can be represented with a bit, using 0 for white and 1 for black, 
and the human visual systems performs an OR of the input pixels in order to 
reconstruct the secret pixels. 

This key property does not easily extend to colored pixels. With colored 
pixels the state of each pixel cannot be represented anymore with a single 
bit and the ’’reconstruction” operation performed by our eyes is much more 
complicated than a simple OR. 

In this chapter we will first describe the difficulties that arise from the 
superposition of colored pixels and then we review the work on visual cryp- 
tography for colored images. 

We assume that the reader is familiar with (at least the basics of) black 
and white visual cryptography. 


2.2 Color Superposition 

What happens when we stack together two transparencies so that two pixels 
get superposed? What is the color that the human eyes see as the result of 
this superposition? Figure 2.1 illustrates the superposition operation with two 
examples. In the first one we are using black and white pixels: the superpo- 
sition of a black pixel with a white pixel yields a black pixel. In the second 
example, we are using colored pixels: the superposition of a yellow pixel with 
a magenta pixel yields a red pixels. 

Using only black and white images the result of the superposition of pixels 
printed on transparencies is straightforward: it is black if and only if at least 
one of the pixels is black. 

The answer to the same question gets much more complicated when we use 
colors. In order to understand what happens when we superpose transparen- 
cies with colored pixels we have to talk a bit about light and color theory. 

2.2.1 Color Vision and Color Models 

Modern understanding of light and color vision is based upon the advances 
of several great scientists, such as the ones due to Newton. Thanks to them 
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Bjack pixel White pixel Yellow pixel Magenta pixel 



Resulting pixel: black Resulting pixel: red 


FIGURE 2.1 

(See color insert.) Pixels superposition: black and white (left) and colored 
(right). 


today we have a good understanding of light and colors; the topic is quite 
complex and a rigorous and detailed explanation goes beyond the scope of 
this chapter. However, we will try to explain the basic properties of light and 
colors because they are crucial for any visual cryptography scheme that deals 
with color images. 

Roughly speaking, light consists of electromagnetic energy with wave- 
lengths in the approximate range of 350-750 nm, as shown in Figure 2.2. 
The visible range represents only a small fraction of the full electromagnetic 
spectrum. 



Gamma Rays X-Rays 


350 nm 


Infrared 


Microwaves 

1 h 


Visible light 


Radio frequency 

+ 


750 nm 


10 6 10 9 
Wavelength (m) 


FIGURE 2.2 

(See color insert.) Electromagnetic spectrum. 

When a particular wavelength in such a range hits the retina in our eyes, it 
is perceived as a color. In the visible range, shorter wavelengths are perceived 
as bluish colors, middle wavelengths as greenish colors, and higher wavelengths 
as reddish colors. When our eyes are hit by several wavelengths we perceive a 
color that is a sort of ’’sum” of the wavelengths. If the eyes are hit by all the 
visible wavelengths, the perceived color is white. That is, a (pure) white light 
consists of all the visible wavelengths. 

The expressions ’’red light,” ’’yellow light,” etc., are technically incorrect, 
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but we will often use them to mean a light whose wavelength is perceived 
as red, yellow, etc. Since each wavelength corresponds to a color, there are 
infinite colors, one for each possible wavelength. 

An object appears to be of a particular color because when light hits the 
object some light is absorbed, that is some wavelengths are absorbed; the 
remaining wavelengths are perceived by our eyes. When light hits an object 
it can also be reflected (or pass through the object). An object of a particular 
color \i has strong absorption properties for the wavelengths that do not 
correspond to % while it reflects the light with color For example, an object 
appears yellow (when hit by a white light) because it reflects the yellow light 
and absorbs most strongly in the other parts of the spectrum. In the case of a 
transparency, the light that is not absorbed instead of getting reflected passes 
through the transparency. 

A color model is a formal model that allows us to represent all (or some 
of) the possible colors. One of the most used color model is the one called the 
’’additive color model.” With this method three primary colors (usually red, 
green, and blue) are mixed to obtain other colors. Figure 2.3 shows this model 
with the primaries red, green, and blue; the colors yellow, cyan, and magenta 
are produced when two of these primaries overlap. Varying the ’’intensity” of 
each primary in the mixing we can obtain many other colors. 



FIGURE 2.3 

(See color insert.) Additive color model with primaries red, green, and blue. 

The set of all possible colors that we can obtain depends on the three 
primary colors that we use. Any three colors can be used as primaries; the 
range of colors that we obtain is the gamut of those primaries. Unfortunately, 
no three primary colors exist so that their gamut corresponds to the set of 
all possible colors; however by choosing red, green, and blue as primaries we 
obtain a very large number of colors in their gamut. This is why these three 
colors have been chosen for the additive color model and the model is often 
called Red, Green, and Blue (RGB). Most displays use this model. 

Another color model is the ’’subtractive color model,” also called the Cyan, 
Magenta, and Yellow (CMY) model. In this case the colors are obtained with a 
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subtractive technique that starts from a white light and subtracts wavelengths 
corresponding to the three colors cyan, magenta, and yellow. Figure 2.4 shows 
the CMY model. 


Y 



FIGURE 2.4 

(See color insert.) Subtractive color model with primaries cyan, magenta, and 
yellow. 

Most modern printers use this model, often exploiting an additional black 
ink; an additional K in the name CMYK indicates the use of the extra black 
ink. Notice that we can obtain black by using all three inks (cyan, magenta, 
yellow) together; however it is more efficient to cover a pixel with just black 
ink, rather covering it with the three inks cyan, magenta, and yellow. 

In the additive model we start from the absence of light, which gives the 
black color, and we add light to obtain other colors with the extreme case 
being the white color obtained when we add all possible wavelengths. In the 
subtractive model we start from a white light and we subtract wavelengths 
to obtain other colors with the extreme case being the color black obtained 
when we take out all possible wavelengths. 

If we are not very picky, and a discussion about this aspect goes beyond 
the scope of this chapter, we can say that the RGB and the CMY models are 
equivalent and complementary. Indeed an ink with the color cyan absorbs the 
light corresponding to the red color, an ink with the color magenta absorbs 
the light corresponding to the green color, and an ink with the color yellow 
absorbs the light corresponding to the blue color. Because of this, for both 
models, we will formally represent a color \ as a triple (x, y, z), where x, y, and 
z denote the amount of red, green, and blue, respectively, that \ consists of. 
The amount of each type of light (red, green, blue) is described by an integer 
in the range [0, L]. With this setting, we can produce (L + l) 3 different colors, 
which, for L sufficiently large, are enough to approximate all colors that the 
human eyes are able to distinguish. Typically, for computers, we have L = 255. 
To make things easier, throughout this chapter, we use L = 100. 

Each of the components x,y, and z can be seen as a filter that lets pass 
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through only some light. The color (0,0,0), which we will denote also with 
the symbol is the black color: indeed all filters are 0, meaning that there 
is no light left. The color (100, 100,100), which we will denote also with the 
symbol ”o,” is white because no light is absorbed by the filters. The colors 
red, green, and blue are represented, respectively, by (100, 0, 0), (0, 100, 0), 
and (0,0,100); we will refer to these colors also as R, G, and B, respec- 
tively. The colors cyan, magenta, and yellow are represented, respectively, 
by (0, 100, 100), (100, 0, 100), and (100,100,0); we will refer to these colors 
also as C, M, and Y, respectively. The color (50, 0, 0) is also a red, because that 
is the only component present, but it is darker since some red light has been 
absorbed. The higher the value of the component, the lighter is the color. If all 
components are equal, i.e., ( x,x,x ), then the resulting color is a gray whose 
intensity depends on x: the smaller is x, the darker is the gray. 

Recall that this representation works fine both for the additive model and 
for the subtractive model. In the additive model we start from (0, 0, 0) and add 
light while in the subtractive model we start from (100, 100, 000) and subtract 
light. 

In the context of visual cryptography we can think of the transparencies as 
filters; starting from a white light we ’’subtract” some light applying filters (the 
transparencies). The remaining light determines the color that we see when 
superposing several transparencies. At this point it is worth emphasizing that 
’’white” on a transparency is actually ’’transparent.” We assume to start with 
a pure white light; if the transparency does not have any ink on it, then the 
white light just passes through the transparency and we see white. 

What is the color of the pixel resulting from the superposition of one or 
more transparencies? 

When we drop some ink on the transparency and hold the transparency 
to the light we see the color that the ink lets pass through. When more trans- 
parencies get stacked together, the color of the resulting pixel depends on the 
absorption properties of the inks on all of the transparencies. 

Let xi — i x i^yii z i) and Xi = { x 2 ,y 2 , z 2 ) be two colors and assume that 
two pixels of color \i and of color \2 ar e printed on two different transparen- 
cies. 

The following operator add describes the color superposition operation: 

add(X 1 ,X2) = (int (^f 2 ) , int (^) , int (^)) . 

Notice that taking into account only the inks that we have used for each 
transparency is a simplification: the perception of the final color depends also 
on the material of the transparencies and the aberrations that the stack of 
transparencies produces. Moreover, it is likely that the initial light we start 
with is not a pure white light and that there are also other sources of light in 
the environment. However, the add operator is a quite good approximation. 

The add operation is commutative and thus the order in which we su- 
perpose the colors is irrelevant. As expected, it results that add(Y, M) = R, 
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add(R, G) = Y, add(Y, M, C) = •. Figure 2.5 shows some other examples of 
superposition of colored pixels. 



FIGURE 2.5 

(See color insert.) Examples of pixels superposition. 

The add operator can be easily extended to any number of pixels. Indeed 
since the operation is commutative it is enough to add any two pixels each 
time until we get to one pixel. Let Xi = (*i, 2/1, Zi), X2 = (x 2 , 2 / 2 , z 2 ), . . . , Xn = 
(x n , l In, z n ) be the colors of the pixels. The color of the pixel that results from 
the superposition is: 


*dd(xi, X2, • • • , Xn) = (X, Y, Z) 


where 


X=int( XlX ^r: Xn ) 1 Y=int( ym --- yn 


V )'* —V L"-1 " Z ~ int 

Figure 2.6 shows examples of superpositions with 3 pixels. 


/ZiZ 2 ■■■ z n \ 

l L "- 1 ) 


f ) (100,100,50) 

( ) (100,70,90) 

(100,50,100) 

160,90.80) 

(50,100,100) 

- — 

120,20,100) 

(^) (50 50,50) 

(12,13,72) 


FIGURE 2.6 

(See color insert.) More examples of pixels superposition. 


2.2.2 Lattices 

Some papers (e.g., [7]) use finite lattices to formalize the properties of the 
superposition of colored pixels. A finite lattice is a partially ordered set for 
which any two elements of the set have a least upper bound and a greatest 
lower bound. We can use a lattice to describe a color model. 
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# (black) 



Blue 


Cyan 


FIGURE 2.7 

Lattice for the RGB and CMY color models. 


In the additive model the superposition of two colored pixels corresponds to 
the greatest lower bound while in the subtractive color model the superposition 
corresponds to the least upper bound. The choice of a particular lattice is 
equivalent to the choice of a color model. For example, the lattice in Figure 2.7 
is equivalent to the color model that uses the following 8 colors: black, white, 
R, G, B, C, M, and Y. Notice that this particular set of colors is closed under 
the superposition operation. It is worth emphasizing that this lattice is not 
equivalent to the RGB and CMY models: it only considers the 8 colors with 
zero or full intensity while the RGB and CMY models have many more colors. 

2.2.3 The Darkening Problem 

When we superpose pixels having the same color, unless we have zero or full 
intensity components, the resulting pixel is a darker version of the original 
color. This is because each transparency is a filter that absorbs some light, 
except when the transparency is white, and thus the resulting pixel is darker. 
Figure 2.8 shows examples of superposition of pixels with the same color, a 
light grey. As can be noticed in the figure, as we add more pixels the resulting 
color becomes darker, with the limit being a full black. 

We will refer to this problem as the darkening problem. Some of the schemes 
that we will describe later superpose pixels with the same color, but ignore 
the darkening problem. 
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FIGURE 2.8 

The darkening problem. 

2.2.4 The Annihilator Color 

Since for any color \ we have that add(y, •) = •, in many visual cryptography 
schemes for color images the black color is often used to ’’cover up” other 
colors so that they don’t show up in the reconstructed image. For this reason 
we call the black color the ’’annihilator” color. The presence of the annihilator 
color in the reconstructed image has no meaning and thus the observer has to 
ignore it. The use of the annihilator color is not a problem from a formal point 
of view but the visual effect is not good: in many cases the presence of the 
annihilator color in the reconstructed image is overwhelming (e.g., 90% of the 
image) and thus it is not reasonable to assume that the observer can recognize 
the secret image. This is clearly a problem if we want to share images, but it 
doesn’t rule out some applications as we will see in later sections. We remark 
that the annihilator color, has nothing special: it is just the black color! If 
the secret image contains black pixels, then we will not be able to distinguish 
amongst the black pixels in the reconstructed image which ones were originally 
black and which ones were annihilated. 


2.2.5 The Identity Color 

Color o is the ’’identity” color, in the sense that for any color \ we have that 
add(y, o) = x- In some schemes the identity color is used, together with the 
annihilator color, as a special color. Recall that that in the context of visual 
cryptography white is actually transparent. 
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2.3 Formal Models for Colored VCS 

In this section, we discuss the formal model for color visual cryptography, or 
Color-VC for short. We first recall the basic properties of the formal model for 
black and white visual cryptography, B&W-VC for short, that will be needed 
also for the case of color images and then we dwell upon the problems that 
need to be tackled in order to define a formal model for Color-VC. 

2.3.1 The Models for B&W-VC 

For B&W-VC the formal models used in the literature are all equivalent (with 
variations on the metrics used for evaluation, like for example the contrast of 
the scheme) . The two key properties, that will be needed also for color images, 
are: 

• the safety property, which guarantees that nonqualified sets of participants 
are not able to reconstruct the secret image; 

• the contrast property, which guarantees that qualified sets of participants 
are able to reconstruct the secret image. 

To evaluate visual cryptography schemes the most important metric is the 
pixel expansion, that is the number of subpixels used in the reconstructed 
image for each pixel of the secret image. 

Another important measure for the evaluation of B&W-VC schemes is the 
contrast of the reconstructed image that can be defined as a function of the 
contrast property. Several contrast properties and metrics can be found in 
literature for B&W-VC. We refer the reader to the relevant papers about the 
contrast (see for example [5]). 

With the exception of the definition of the contrast, the formal model for 
B&W-VC is pretty standard. 

2.3.2 The Models for Color-VC 

For color images even the model becomes difficult to define. Do we start 
with a prespecified palette, perhaps the one used in the secret image, or do 
we consider all possible colors? What color model do we consider? Do we 
consider the darkening problem? Is the palette closed under the superposition 
operation? That is, if we start with a prespecified palette, do we consider the 
possibility that the reconstructed image contains colors that are not in the 
original palette? How do we define the contrast property for color images and 
what is the contrast metric? Do we allow the use of the annihilator color? 
How do we account for it in the contrast property? 
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In the following, we discuss all these issues. We start by defining the secret 
and the shares palettes as follows: 


• Secret palette: this is the set of colors used in the secret image. This is a 
finite set of c colors (we can have at most one color per pixel). To make 
notation easier we will denote these colors simply with the set of integers 
{1,2,..., c}. For the colors white, black, red, green, blue, cyan, magenta, 
and yellow we will also use the corresponding symbol (o, •, R, G, B, C, M, Y) 
instead of the palette index. 

• Shares palette: this is the set of colors that we can print on the shares or 
obtain by superposing printed shares. The shares palette might be the same 
as the original palette, or it might be augmented with some (or even many) 
other colors. Most of the schemes used in the literature augment the shares 
palette with the colors o and •. We denote the colors in the shares palette 
with the set of integers {1,2 , ,d}. When the shares palette is a superset 
of the secret palette (this is the case in almost all of the scheme presented 
in this chapter) we have that d > c and to simplify the notation we assume, 
without loss of generality, that the first c colors of the shares palette are 
exactly those in the secret palette. 


The secret image consists of a collection of pixels, each one with a color of 
the secret palette. As for B&W-VC, each pixel of the secret image is encoded 
in the shares into a certain number m of subpixels. Such an integer in is the 
pixel expansion of the scheme. 

In order to define a scheme we need to specify the qualified and the non- 
qualified set of participants. There are n participants. For simplicity we con- 
sider only the case of threshold schemes: Any set of at least k participants is 
a qualified set, while any set with less than k participant is a nonqualified set 
of participants. 

In order to share each pixel of the secret image a trusted third party has to 
create and distribute shares to the n participants. The creation of the shares 
is defined using distribution matrices. These are c collections (multisets) of 
n x m matrices C 1 ,!! 2 , ...,C C , whose elements are in the shares palette. 

To share a secret pixel of color i, the dealer randomly chooses one of the 
matrices in C l and distributes row j to participant j. Thus, the chosen matrix 
defines the m subpixels in each of the n transparencies. 

An example of distribution matrix is the following: 


D = 


1* 1M1 
R 1 1 o 2 
211*3 
oMlGB 


In this case, there are n = 4 participants (number of rows in the distri- 
bution matrices) and the pixel expansion of the scheme is m = 5 (number of 
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columns in the distribution matrices). If D is the matrix selected for the dis- 
tribution of the shares then the 5 subpixels in the first share will have colors 
1*1M1, while those in the second share will have colors Rllo2. 

Given a distribution matrix M and a set of participants X, we denote 
with M | X the submatrix of M obtained by considering only the rows of M 
corresponding to the participants in X . 

As for the black and white case, the definition of a scheme must satisfy 
the security and the contrast properties: 

Security property : Given a forbidden set X, |X| < k, the c collections of 
|A| x?n matrices, T> 1 , i = 1,2, ..., c, consisting of M\X for each M £ C\ contain 
the same matrices with the same frequencies. This property guarantees that 
a forbidden set of participants has no information on the secret image. 

Contrast property. The contrast property has to guarantee that the secret 
image will be visible for a qualified set of participants. For B&W-VC this 
property uses two thresholds £ and h, with £ < h, and requires that when the 
secret pixel is white, the number of black subpixels in the reconstruction is at 
most l and when the secret pixels is black, the number of black subpixels is 
at least h. Many papers that deal with color images generalize this definition 
requiring that in the reconstructed pixel there are at least h subpixels of color 
i, where i is the color of the secret pixel, and for any other color j ^ i there 
are at most t subpixels with color j. Notice that this definition can be used 
only if the shares palette is equal to the secret palette. Moreover, it allows 
the possibility that the reconstructed pixel is made up of an overwhelming 
majority of subpixels with a wrong color. For example if h = 4, l = 3, and 
c = 10 it is possible to have in the reconstructed pixel only 4 subpixels with the 
right color while other 27 = 3 • 9 have (mixed) wrong colors. The annihilator 
color • can be present without any restriction. 

Probably a better definition of the contrast property should require that 
in the reconstructed image there be at least h subpixels with the right color 
and at most l subpixels with wrong colors. That is, the number of subpixels 
with the right color should be greater than the number of subpixels with a 
wrong color (counting all the subpixels with wrong colors). 

We will refer to the first property as the weak contrast property and to the 
second one as the strong contrast property. 

Next, we provide a formalization of such properties. Define the add(M) for 
a distribution matrix M to be the vector whose j th component is the add of 
column j in M and define Wi(v) for a vector v to be the number of elements 
equal to color i, for * = 1, 2, ... , c, that is for any color in the secret palette. 
Moreover we define Wi(v) to be the number of elements in v different from 
color i and from the annihilator color. 

Weak contrast property: There must exist h and £, integers 0 < £ < h < m, 
such that given a qualified set X, \X\ = k, for any M £ C l , it holds that 
Wi(&dd(M | A)) > h and Wj(add(M|X)) < £ for any j in the shares palette 
and j ^ i. Note that the annihilator color is not considered, that is, it is 
allowed that many pixels be •. 
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Strong contrast property : There must exist h and £, integers 0 < t < h < m, 
such that given a qualified set X, \X\ = k, for any M € C\ it holds that 
u>i(add(Af |A)) > h and «h(add(M|X)) < I. Also in this case the annihilator 
color can be present without restriction. 

In the black and white case, the thresholds l and h, together with the pixel 
expansion m have been used to define several variants of the contrast metric, 
such as a = h—£, a = ( h—Cj/m , and a = (h— £)/(h+(). Similar measures have 
been used for color schemes and we will specify the definition of the contrast 
when presenting the schemes. However, for Color- VC schemes we need to 
account for the presence of the annihilator color in the reconstructed image 
and this makes the contrast less important. We will evaluate the annihilator 
presence that we can define as (3 = b/m., where b is the number of pixels that 
get annihilated in the reconstruction process. 


2.3.3 The SC, ND, and General Models 

The schemes that we will review in the rest of the chapter can be classified, 
based on the formal model that they use, into three classes. In the next para- 
graph we define three formal models for Color-VC. 


The SC (Same Color) model. 

The SC model does not allow the superposition of pixels with different colors, 
with the exception of the identity (o) and the annihilator (•) colors. Hence, 
the shares have to be constructed in such a way that each column in the 
distribution matrices have elements taken from the set {i, o, •}, for some color 
i. Thus, when we superpose several transparencies, we never have a pixel of 
color i superposed with a pixel of color j. 

Moreover the darkening problem is ignored. That is, it is assumed that 
superposing several pixels with color i, the resulting color is still i. 

An example of a distribution matrix for such kinds of schemes is the fol- 
lowing (we have used three colors, denoted with the numbers 1,2, and 3): 


3111*222o*33*3o**ol*o*2 

311*122*2*3*3o3**l*oo2* 

31*112*223o3**3*l***2«* 

3olll*2223**33*l***2ooo 


As can be noted, in each column, we either have colors o, •, or pixels with 
a color % = 1, 2, or 3. We never have a column that mixes two different colors 
in the set {1, 2, 3}. 

This restriction and the fact that the darkening problem is ignored avoids 
the complications that derive from color superposition. 
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The ND (No Darkening) Model. 

The ND model is as the SC model but it considers the darkening problem. 
Thus, again we cannot superpose pixels with different colors, but if we su- 
perpose several pixels with the same color we get a darker version of that 
color. 

The General Model. 

In the General model, there are no restrictions about the superposition of pix- 
els and the superposition operation satisfies the real properties of color super- 
position. This means the darkening problem is considered. Very few schemes 
have been defined for this model. 

2.3.4 Base Matrices 

Given a matrix B , we denote by C{B) the set of matrices obtained by permut- 
ing in all possible ways the columns of B. In most schemes, the c collections 
C l are obtained by fixing c matrices B l , i = 1, 2, . . . , c, and letting C l = C(B l ). 
The matrices B l are called the ’’base matrices.” Base matrices constitute an 
efficient representation of a scheme. Indeed, the dealer has to store only the 
base matrices and in order to randomly choose a matrix from C(B l ) it has to 
randomly choose a permutation of the columns of the base matrix B l . 

Notice that the security property for a base matrices scheme is equivalent 
to: Given a forbidden set X, the matrices B l \X, for i = 1,2,... , c are the 
same up to a permutation of the columns. 


2.4 Schemes for the SC Model 

In this section, we review the known schemes for the SC model. Verheul and 
van Tilborg [10] were the first to consider visual cryptography schemes for 
color images. Their model is equivalent to the SC one; as we will see shortly 
their model requires a special property, which can be easily implemented us- 
ing the SC model. The schemes of [10] were improved first by [2] and then 
by [7, 11]. Paper [3] provides a lower bound on the pixel expansion and also 
the construction of (?i, n)-thresholcl schemes that achieve the lower bound. 
It turns out that the (n, n)-threshold schemes of [7, 11] also have optimal 
pixel expansion, which means that the schemes of [3] and those of [7, 11] are 
equivalent. 


© 2012 by Taylor & Francis Group, LLC 



Visual Cryptography for Color Images 45 

2.4.1 The VV Schemes 

The model considered in [10], which we will call the VV model, requires a 
special property: if we superpose pixels with different colors then the resulting 
pixel is black. As we have explained earlier, this property is not natural. 
When we superpose two pixels with different colors, we get a third color that 
depends on the colors of the two superposed pixels. In some particular cases 
the resulting color is actually black, but it is not black in most cases. 

Verheul and van Tilborg propose a trick that ’’implements” such a prop- 
erty. The trick works as follows: each pixel is divided into c subpixels, where 
c is the number of colors in the secret image, subpixels i gets color number i, 
while all other subpixels get painted with black, as shown in Figure 2.9. 




FIGURE 2.9 

(See color insert.) The VV trick for the case of 4 colors. Subpixels with different 
colors are never superposed. 

This trick implements the required property and makes the VV model 
equivalent to the SC model because in the resulting scheme subpixels with 
different colors are never superposed. However, to implement the trick, we 
have to pay an extra pixel expansion factor of c and a considerable fraction 
of the original pixel gets annihilated in the reconstruction. 

The schemes of [10] are constructed using finite fields that satisfy certain 
conditions. We refer the reader to the original paper for a detailed description 
of the construction. 

Assuming that c > 2 is a prime power, the construction produces 

• ( k , fc)-threshold schemes with c colors for any k: 

• ( k,c — l)-threshold schemes with c colors for k < c; 

• (k, c)-threshold schemes with c colors for k < c, if k — 1 and c — 1 are not 
relatively prime. 

The pixel expansion of the schemes is m = c fc ; this includes the pixel 
expansion m = c k ^ 1 due to the construction of the scheme and the extra c 
factor due to implementation of the special property of the VV model. 

The reconstruction guarantees that there is at least one pixel of the original 
color and no pixels with other colors, that is h = 1 and t = 0. The contrast 
property property considered is the weak one. However, we note that when l = 
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0 the weak and the strong contrast property are equivalent. The annihilator 
presence /3 = (m — 1) /m, that is only one out of the m pixels is of the original 
color, while the remaining in — 1 are annihilated. 

As an example, we report the (3, 3)-threshold 3-color scheme. Here are the 
three base matrices: 


B 1 


B 2 


B 3 


111 
12 3 
12 3 

111 
12 3 
3 12 

111 
12 3 
2 3 1 


2 2 2 
12 3 

2 3 1 

2 2 2 
12 3 
12 3 

2 2 2 
12 3 

3 12 


3 3 3 
12 3 
3 12 

3 3 3 
12 3 

2 3 1 

3 3 3 
12 3 
12 3 


The pixel expansion, that corresponds to the number of columns in the 
base matrices, is m = c fc_1 = 3 2 = 9. The above base matrices work only in 
the vv model. Although the annihilator color is not explicitly used, it appears 
because of the special property. Indeed, implementing the special property 
using the trick suggested earlier, the base matrices become the following: 


B 1 = 


B 2 = 


B 3 = 

Hence, the real pixel expansion is m = c k = 3 3 = 27. In this particular 
case superposing 3 shares we get 26 black pixels out of 27 and just 1 colored 
pixel. That is, the annihilator presence is /3 = 26/27 (about 96%). 

This approach doesn’t seem practicable for images, but it can be used for 
other applications, like sharing passwords associating, for example, a digit to 
each color. For example, as reported in [10], if we use pixels of diameter 0.5 
cm with 9 colors we can build a (3, 9)-thresholcl visual scheme with 9 colors 
using 9 2 = 81 pixels for each color of the password; on a standard A4 page 
there is room for a 90 digit password. 


1**1**1***2**2**2***3**3**3 
1...2...3 1 ...2...:! 
1***2***3*2***31****31***2* 

1., 1.. 1... 2.. 2.. 2... 3 
1 • • • 2 • • • 3 1 • • • 2 • • • 1 • • • 2 • • • 3 
••31***2*1***2***3*2***31** 

1 • • 1 • • 1 • • • 2 • • 2 • • 2 • • • 3 • • 3 • • 3 

1.. .2...3 1 ...2.*.31 .••2.*.:i 
•2***31****31***2*1***2***3 


© 2012 by Taylor & Francis Group, LLC 



Visual Cryptography for Color Images 

2.4.2 The BDD Schemes 


47 


Blundo et al. [2] focus on schemes with maximal contrast. They consider the 
weak contrast property and define the contrast as a = (h — £)/(h + £). The 
following results are provided in [2]: 

• A first construction of c-color (2, n)-threshold Color-VC schemes with max- 
imal contrast. The construction requires c > n. 

• A proof that the above condition c > n is necessary to have a maximal 
contrast scheme. It turns also out that, among the schemes with maximal 
contrast, the schemes provided by the first construction are also with optimal 
pixel expansion. 

• A second construction of c-color (2, ?i)-threshold Color-VC schemes. Such a 
construction gives a better pixel expansion with respect to the first one but 
the schemes are not with maximal contrast. 

• A construction of maximal contrast c-color (n, n)-threshold Color-VC 
schemes with improved pixel expansion with respect to those provided 
in [10]. 

We refer the interested reader to [2] for details about the constructions 
and the lower bound cited in this section. 

2.4.3 The KY and YL Schemes 

Koga and Yamamoto [7] and independently, Yang and Laih [11] provide (fc, n)- 
threshold c-color schemes that improve on the pixel expansion of the schemes 
in [10, 2]. Here we report the construction provided in [11], but the one in [7] 
is equivalent. 

Construction 1 The construction exploits as a building block the base ma- 
trices B 0 and B, of a scheme for black and white images. In order to obtain 
the base matrix Bi for color i we can concatenate one modified copy of B 0 
with c — 1 modified copies of B,. The required modifications are the following: 
in B 0 we substitute o with color i while in the c — 1 copies of B t we substitute 
o with the remaining c — 1 colors (one color per copy). The pixel expansion 
of the c-color scheme is c times the pixel expansion of the original black and 
white scheme. 

As an example, consider the following (3, 3)-threshold 3-color scheme. We 
start with the base matrices of a (3, 3)-threshold scheme for black and white 
images as defined in the paper by Naor and Shamir [8] (however, the con- 
struction works with any other choice of the black and white base matrices): 


o • o • 


• o o • 

o • • o 

B m = 

o • o • 

o o • • 


o o • • 
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Then we construct the base matrices for the 3-color scheme as follows: 

1 • 1 • • 2 2 • • 3 3 • 

Bi = [B°-" 1 \B°-" 2 \B°^ 3 ]= 1 • • 1 2*2* 3*3* 

1 1 • • 22** 33** 

•11* 2*2* • 3 3 • 

B 2 =[B°^ 1 \B°^ 2 \B°^ 3 } = 1 • 1 • 2 • • 2 3*3* 

1 1 • • 22** 3 3 • • 

•11* *22* 3*3* 

B 3 = [B°^ 1 \B°^ 2 \B°^ 3 }= 1*1* 2*2* 3 • • 3 

1 1 • • 22** 33** 

Using as a building block the original (fc, n)-threshold scheme provided in 
the paper by Naor and Shamir [8], whose pixel expansion is 2 k ~ 1 , the c-color 
schemes so obtained have pixel expansion m = cx 2 fe ~ 1 . This greatly improves 
on the pixel expansion of [2, 10]. 

Finally, as observed, also in [11], we can delete from the base matrices the 
columns that have all pixels with color •. Using the base matrices provided in 
the paper by Naor and Shamir [8], for n even we always have one such column 
in each base matrix, while for n odd we always have c — 1 such columns 
in each base matrix. Hence, the pixel expansion can be further improved to 
m = c x 2 fc_1 — 1 for n even and to m = c x 2 fc_1 — c + 1 for n odd. This is 
important as we will see that for k = n this improved pixel expansion matches 
a lower bound proved in [3] . 

The contrast property considered is the weak one. The scheme have pa- 
rameters h = 1 and I = 0 (recall that for the special case of l = 0 the weak 
contrast property is equivalent to the strong one) . The annihilator presence is 
/ 3 = (to — l)/m. 

The same idea used for the construction of c-color (fc, ?r)-threshold schemes 
starting from black and white ( k , n)-threshold schemes, can be used also for 
general access structure schemes. The pixel expansion of the c-color scheme is 
c times the pixel expansion of the black and white scheme that we start with. 

2.4.4 The CDD Schemes and a Lower Bound 

Paper [3] defines the contrast as a = (h—I)/m and considers the weak contrast 
property. The following theorems are proved in [3]: 

Theorem 1 In the SC model, the optimal contrast of a c-color (n,n)- 
threshold scheme is 

{ „„ 1 1 — r, if n is even 

c - 2 - 1 j 

e . 2 „— i— c+i i if n is °dd- 
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Theorem 2 In the SC model, the pixel expansion of a c-color (n, n) -threshold 
scheme, for any c,n> 2, is lower bounded by 


to > 



1 , if n is even 
c+l,if n is odd. 


Note that the above lower bound implies that the schemes of [7, 11] have 
optimal pixel expansion. In [3] an alternative construction of c-color (n,n)- 
threshold schemes with optimal pixel expansion is provided. The construction 
is the following: 


Construction 2 Fix any color i; base matrix C l consists of the following 
columns: 

1. for r = 0, 1, ... , [n/2] — 1 include the (r) columns, having 2 r 
entries equal to • and the remaining ones of color i; 

2. for any color j ^ i, for r = 0, 1, . . . , |" — 1 include the ( 2 " x ) 
columns having 2r — 1 entries equal to • and the remaining ones of 
color j; 


Below is an example for c = 3 and n = 4. For such a scheme m = 23 and 
a = 1/23. 

1222*333**11*1****2***3 
i 122*233*3*1*1*1**2***3* 

C = 12*223*331*1**1*2***3«* 

1*222*3331**11*2***3*«* 

2111*333**22*2****1***3 
„ 2 _ 211*133*3*2*2*2**1***3* 

° “ 21*113*332*2**2*1***3** 

2*111*3332**22*1***3*** 

3111*222**33*3****1***2 
„ 3 311*122*2*3*3*3**1***2* 

31*112*223*3**3*1***2** 
3*111*2223**33*1***2*** 

Other results of [3] are 

• A characterization of maximal contrast ( k , n)-thresholds schemes. The char- 
acterization describes the schemes with a linear programming problem. 

• A construction of c-color (2, ?r)-threshold schemes with improved pixel ex- 
pansion with respect to [10, 11]. 


© 2012 by Taylor & Francis Group, LLC 



50 


Visual Cryptography and Secret Image Sharing 


2.5 Schemes for the ND Model 

In this section we describe schemes that work for the ND model. This model 
has been considered only in [4] where a construction for c-color (k, n)-threshold 
schemes is presented. 

In order to have pixels with exactly the same color as the original one the 
schemes of [4] have the property that in any shares superposition at most one 
pixel is colored; all other pixels have one of the two special colors o or •. 

The construction uses as a building block a black and white (k — l,k — 1)- 
threshold scheme. 

Construction 3 Let S%_ 1 and S'*-! be ^ le basis matrices of a(k—l,k — 1)- 
threshold scheme and let m! he the pixel expansion of such a scheme. Denote 
the rows of Sf._ 1 and 5*_ 1 with Wi and bi, respectively: 



Let S* = [•] and S') = [o]. Then let Fk^ n (i,S^_f), where i £ {1,2, ...,c} 
and cj> £ {o,*} he the n x (?)m' matrix constructed by (?) submatrices, called 
’’blocks, ” with dimension n x to' each consisting of the following rows: n — k 
(’’black”) rows of m! elements •; Each block differs from the others in the 
choice of the n — k ’’black” rows; The remaining k rows are filled with one row 
of elements equal to i followed in order by the k — 1 rows of S‘^_ 1 . 

Base matrix for color i, fori £ {1, 2, ..., c}, is given by 

B l = Fk, n (l, Sfe-i) + • • • + Fk^ n (i — 1, iS*_i) + Fk tn (i, S^_f) + 

Fk,n(i + 1) S’*-!) + ■ ■ • + -Ffe,n(c, /S'*_ 1 ) 

where + denotes the concatenation of the matrices. 

An example will clarify the above construction. Let k = 3 and n = 4 and 
consider the matrices and Sf._ , given by the Naor and Shamir (2,2)- 
threshold scheme [8], that is, 



The F matrices will have (^) = 4 blocks, since we have to place 1 black row 
in each of 4 possible positions. Hence, we have 
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F 3A (i,S° 2 ) 


i i 

ii 

ii 

• • 

o • 

o • 

• • 

ii 

o • 

• • 

o • 

o • 

• • 

o • 

o • 

o • 


F 3A (i,S' 2 ) 


i i 

o • 

• o 

• • 


i i 

o • 
• • 
• o 


i i 

• • 
o • 
• o 


• • 

i i 

o • 
• o 


The vertical bars identify the 4 blocks. As can be seen each block is given by 
1 black row, and the remaining rows filled, in this order, by one row of z’s and 
the rows of S 2 (or S * ) , from the first to the last. Using the above F matrices 
we can build the following 3-color (3, 4)-threshold scheme. 


B 1 


B 2 


B 3 


mm.. 

o*o***ll 
o***o*o* 
• • o • o • o • 

222222 ** 

o*o***22 

o***o*o* 

•*o*o*o* 

333333** 

o*o***33 

o***o*o* 

•*o*o*o* 


222222 ** 

o*o***22 

•o**o*o* 

•**o*o*o 

111111 ** 

o*o***ll 

•o**o*o* 

•**o*o*o 

111111 ** 

o*o***ll 

•o**o*o* 

•**o*o*o 


333333** 

o*o***33 

•o**o*o* 

•**o*o*o 

333333** 

o*o***33 

•o**o*o* 

•**o*o*o 

222222 ** 

o*o***22 

•o**o*o* 

•**o*o*o 


Construction 3 builds a c-color (&, n)-threshold scheme with pixel expan- 
sion m = c(?)m / , where m! is the pixel expansion of the black and white 
scheme used as building block. The thresholds I and h depend on the b&w 
scheme used as building block, If such a scheme is with perfect reconstruction 
of black pixels the resulting scheme has t = 0, h > 1. Notice that the contrast 
property satisfied is the weak one. 

Using as a building block the best, with respect to the pixel expansion, 
b&w {k — 1, k — l)-threshold scheme, provided in [8], whose pixel expansion 
is m! = 2 k ~ 2 , the resulting scheme has pixel expansion 



For k = n the pixels expansion is m = c2"^ 2 . The model assumes the weak 
contrast property. The parameters h and I are h = 1 and t = 0 and the 
annihilator presence is (3 = (m — 1) /m. 

We remark that the schemes of [4] are constructed with the restriction that 
the shares have only one colored pixel. This is not a restriction on the model 
but just on the kind of schemes that can be constructed. Although this limits 
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the search space for good schemes, it guarantees that the reconstructed pixels 
are exactly of the same original color (and not a darker version of it). 

If we consider a model that requires this special property the c-color (n, n)- 
threshold schemes of [4] are optimal with respect to the pixel expansion: 

Theorem 3 [4] If the shares are restricted to he such that for any superposi- 
tion it is possible to have at most one colored pixel, any c-color (n, n) -threshold 
scheme has pixel expansion m > c2 n ~ 2 . 

Other results presented in [4]: 

• A construction of c-color (2, n)-threshold with pixel expansion m = c(n — 1). 

• A matching lower bound m > c(n — 1) . 

• A construction of c-color (2, n)-threshold with contrast a = — . The contrast 
is defined as a = (h — t) /m and the thresholds h and I satisfy the weak 
contrast property. 

• An upper bound on the contrast a < —. This matches the construction for 
k = 2. 


2.6 Schemes for the General Model 

In this last section we finally describe schemes for Color-VC that consider 
the General model, that is we consider schemes that superimpose pixels with 
different colors. In the rest of the section, we present several (2, 2)-threshold 
schemes from [7, 1] and a construction for (2, n)-threshold schemes from [1]. 

2.6.1 (2, 2)-Threshold Schemes 

In this section, we present schemes for the particular case of k = n = 2. 

Scheme 1 [7] The secret palette is { Y, C, G} while the shares palette is 
{Y, C, G, o, •}. The base matrices are: 


S Y 


Yo.C 
o Y C • 


s c 


C o • Y 
oCY* 


S G 


YCo. 
C Y* o 


It is easy to see that for this scheme the pixel expansion is m = 4 and we 
have h = 2, I = 0. The annihilator presence is (3 = 1/2 because 2 out of 4 
pixels are annihilated. 
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Scheme 2 [7] Both the secret palette and the shares palette are {o, Y, M, C, R, G, B, •} . 
The base matrices are: 


5° = 

oYMC**** 

o***YMC* 

S Y = 

YoMC***« 

oY**MC** 

S M = 

MoCY**** 

oM**CY** 

s c = 

CoYM**** 

oC**YM** 

S® = 

YM C o • • • • 

M Y • • C o • • 

S G = 

CYMo«i«i 

YC**Mo*# 

S B = 

MCYo»»»» 

CM**Yo** 

S' = 

YMCo***# 

••••YMCo 


For this scheme the pixel expansion is in = 8 and we have h = 1, l = 0. 
The annihilator presence is (3 = 7/8 because in most cases 6 out of 8 pixels are 
annihilated and for the color white 7 out of 8 pixels are annihilated. Because 
of this, if we restrict the secret palette to {Y, M, C, R, G, B, •} and add o for the 
shares palette the resulting scheme has h = 2 improving the contrast. 

Scheme 3 [7] Both the secret palette and the shares color palette are 
{o, Y, M, C, R, G, B, •} . The base matrices are: 


' o Y M C • ‘ 
oBGR* 

S Y = 

' Y M C • o ' 
o G RB • 

' M C Y • o ' 
o RB G • 

s c = 

' C Y M • o ' 
oBGR* 

' o Y M C • 
RB G • o 

S G = 

’ o C YM • ' 
GRB#o 

' o M C Y • 
BGR»o 

S' = 

' *o YMC ’ 
o • B GR 



It is easy to see that for this scheme the pixel expansion is m = 5 and we 
have h = 1, t = 0. The annihilator presence (3 = 4/5 because 4 out of 5 pixels 
are annihilated. 

Scheme 4 [1] The secret and shares palette are {R, G, B, C, M, Y} . The base ma- 
trices are: 


S K = 

' Y M C • • o ' 

S G = 

' Y C M • • o ' 

S B = 

' M C Y • • o ' 


M Y • C o • 


C Y • M o • 

CM* Yo. 

S c = 

' CoMY** ' 

s n = 

' M o Y C • • ' 

S Y = 

' Y o C M • • ' 


o C • • M Y 


oM»»YC 

o Y • • C M 


It is easy to see that for this scheme the pixel expansion is m = 6 and we 
have h = 2, t = 0. The annihilator presence (3 = 2/3 because 4 out of 6 pixels 
are annihilated. 
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2.6.2 The (2, n)-Threshold AS Schemes 

In [1] a constructions of (2, n)-threshold schemes is provided. The construc- 
tion uses, as a building block, the base matrix S* for the black color of the 
(2, n)-threshold scheme for black and white images defined in [2]. Matrix S* 
is defined as all the binary column- vector with weight (i„/ 2 |)’ w ith the sub- 
stitutions 1 <-> • and 0 <-> o. For example, for n = 4, we have 

' 100101 
110010 
64 “ 01110 0 
001011 

Then, to obtain the color scheme, the black and white pixels are substituted 
with the rows of a specific (2, 2)-threshold color scheme. For example, using 
the KY scheme for the set of colors {C,Y, G} with m = 4 provided in the 
previous section and substituting • with the first row of the base matrix for 
a given color and o with the second row of the base matrix we get the base 
matrix for that color. For example, to get the base matrix for color Y for the 
(2, 4)-threshold scheme, we substitute in S% the symbol • with Yo*C and the 
symbol o with oYC*. 

The scheme that we obtain is: 



S c 


S Y 


oC»YCoY«CoY»oC»YCoY»oC»Y 
oC»YoC«YCoY«CoYtoCY»oC»Y 
CoY»oC«YoC»YoC»YCoY»CoY» 
CoY»CoY«oC»YCoY»oC»YoC»Y 

oY*CYoC*YoC*oY*CYoC*oY*C ] 
oY«CoY«CYoC»YoC»oYC»oY»C 
YoC»oY«CoY»CoY»CYoC»YoC» 
YoC»YoC*oY»CYoC»oY»CoY»C 


S Y = 


oY«CYoC»YoC»oY»CYoC»oY«C 

oY*CoY*CYoC*YoC*oYC*oY*C 

YoC»oY«CoY»CoY»CYoC«YoC* 

YoC*YoC*oY*CYoC*oY*CoY*C 


2.7 Other Schemes 

In [9] Shyu proposes a construction that is very similar to the one used in [7, 
11]. However, the model, although for many aspects equal to the SC model, has 
a crucial difference: the author assumes that the color perceived by the human 
eyes is an ” average” of the colors present in the subpixels of the reconstructed 
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pixels. For example, if a given surface is evenly covered with red and green we 
should see yellow as a result. Although this is in principle true, in practice it 
works only if the pixels are so tiny and evenly distributed that our eyes are 
not able to distinguish the single pixels and perceives an average color mixing 
the two primary colors. What really happens is that our eyes perceive the 
mixture of red and green. However, this does not mean that we cannot use this 
model. We have to accept the fact that a secret color (yellow, for example) 
is reconstructed as a mixture of other colors (red and green, for example). 
This model allows building schemes with a better pixel expansion, namely 
to = |~logc~| x 2" -1 . The contrast properties that we have used throughout 
this paper are not applicable to this model. 

In [6] Hou proposes a method that first splits the secret image into the 
cyan, magenta, and yellow components and then uses ad-hoc (2, 2)-threshold 
schemes to share those components. Although the paper claims that this 
method is easily extensible to the (k, n)-threshold scheme it is not clear how 
to use the ad-hoc (2, 2)-threshold schemes for the general case of the ( k , n)- 
threshold scheme. A proof of the security property is also missing. 


2.8 Conclusions 

Stepping from visual cryptography for black and white images to visual cryp- 
tography for color images is not immediate. The color model poses some tricky 
questions that arise from the complex behavior of colors superposition. Many 
visual cryptography schemes for color images avoid the problem by not super- 
posing pixels with different colors. Very few known schemes do actually exploit 
color superposition. In this chapter we have first emphasized the difficulties 
that arise from the superposition of colored pixels; then we have provided a 
survey of the models of visual cryptography for color images that have been 
considered in the literature and a survey of the schemes that have been pro- 
posed for such models. 

Visual cryptography for black and white images has been thoroughly stud- 
ied. The case of color images is still pretty much unexplored. A first direction 
of research concerns the definition of a reference model. We believe that the 
General model is the one that best represents the real world. All the models 
proposed in the literature lack a well-defined notion of contrast, which is a 
very important measure for the evaluation of the schemes. A second direction 
of research concerns the search for schemes that do use the properties of color 
superposition. The construction of schemes for color images seems to be much 
more difficult than for black and white images. 
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3.1 Introduction 

Visual cryptography proposed by Naor and Shamir [7] discloses the possibility 
for using human visual ability to perform the decryption process. Specifically, 
one secret image is encoded into two shares that are seemingly random pic- 
tures. By xeroxing them onto transparencies, the dealer distributes the two 
random transparencies to two participants (one share for each participant). 
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Each participant cannot tell the secret from his own transparency, but when 
the two participants superimpose their transparencies pixel by pixel, they 
recognize the secret from the superimposed result by their visual system. Nei- 
ther computational devices nor cryptographic knowledge is required for the 
decryption process. 

With such an interesting characteristic that the decryption process is by 
the human visual system only, instead of any computational device, visual 
cryptography attracts much attention from researchers. In particular, it is 
much useful in situations where computing devices are not available or not 
possible to use. Naor and Shamir [7] first presented k out of n visual secret- 
sharing schemes, which ensure that the secret is concealed from groups of 
less than k participants, while it can be seen by groups of at least k partic- 
ipants when they stack their shares altogether. Since this pioneer research, 
many theoretical results on the construction or contrast (the relative differ- 
ence between the reconstructed white and black pixels in the superimposed 
image) of visual secret sharing schemes for binary images have been proposed 
in the literature [1, 10, 11, 2]. Some studies [4, 5, 9] focused on the practi- 
cal realization of visual cryptographic schemes for gray-level or color images. 

50 far, the above-mentioned results concern sharing “one” secret in a visual 
sense. 

Wu and Chen [12] might be the first researchers to consider the problem 
of sharing two secret images in two shares in visual cryptography. They con- 
cealed two secret binary images into two seemingly random shares, namely 

51 and S- 2 , such that the first secret can be seen by stacking the two shares, 
denoted by Si (g> S%, and the second secret can be obtained by Sf ® S 2 where 
6 denotes the superimposition operation and S f is the result of rotating Si 9 
counterclockwise. Si and S 2 are in the shape of squares of the same size. In 
order to align the encoded pixels on Si and S 2 as well as on Sf and S 2 , they 
designed the rotation angle 6 to be 90°. Nevertheless, it is easy to obtain one 
that can be 180° or 270°. 

Wu and Chang [13] refined the idea of Wu and Chen [12] by consciously 
designing the encoded shares to be circles so that the restrictions to the rotat- 
ing angles ( 9 = 90°, 180°, or 270°) can be removed. Let the two encoded circle 
shares in their approach be denoted as A and B. The first secret is revealed 
by A<S>B, while the second secret is obtained by A~ e ® B where 9 may be any 
angle within (0°, 360°) and A~ 0 is the result of rotating A 9 clockwise. Both 
of the studies successfully share two secrets in two shares in a visual sense. 

Shyu et al. [8] devised an elegant algorithm to achieve the sharing of mul- 
tiple sercte images using two circle shares. It is the first true approach that 
shares any general number of multiple secrets in two shares. Consider x secret 
images. Consider a set of x > 2 secret images. Their scheme produces two circle 
shares A and B such that none of them individually leaks any secret and the x 
secrets can be obtained one by one by A®B, A 6 ®B, A 26 ®B, . . . , A^ x ~A d ^B 
where A^~ 1 ' ,e is the result of rotating A^~ 1 ' )S counterclockwise for 1 < i < x 
for 9 = 360 s /a: and A 0 = A. This is the first true result of sharing multiple 
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secrets in visual cryptography for any x > 2 secrets in two shares. Their pixel 
expansion is 2x , which is the best result so far in the model that each pixel 
would be expanded. 

Based on a different set of encoding patterns, Feng et al. [3] developed 
another scheme to achieve the same goal using two cylinder shares. The pixel 
expansion needed is 3x. 

In this chapter, we introduce these interesting algorithms. The rest of the 
paper is organized as follows. In Section 3.2, we briefly review the visual one- 
secret sharing scheme in two shares proposed by Naor and Shamir [7]. The 
visual two-secret sharing scheme by Wu and Chen [12] and Wu and Chang [13] 
are discussed in Sections 3.3.1 and 3.3.2, respectively. The schemes for visual 
multisecret are examined in Section 3.4 in which the experimental results and 
discussions are also presented. Section 3.5 gives some concluding remarks. 


3.2 Naor and Shamir’s Basic Visual Secret Sharing 
Scheme 

The basic idea of Naor and Shamir’s encoding scheme [7] for sharing a single 
pixel, say p , in a binary image P into two shares Si and S 2 is illustrated in 
Table 3.1. If p is white, the dealer randomly chooses one of the first two rows 
of Table 3.1 to encode si and S 2 - If p is black, the dealer randomly chooses 
one of the last two rows in Table 3.1 to encode si and S 2 - The possibilities of 
the two encoding cases are equally likely to occur, independently of whether 
the original pixel is black or white. Thus, neither S! nor s 2 exposes any clue 
about the binary color of p. When these two shares are stacked together, i.e., 
si <8> S 2 , two black subpixels appear if p is black, while one black subpixel and 
one white subpixel appear if p is white as indicated in the rightmost column in 
Table 3.1. Based upon the contrast between these two kinds of reconstructed 
pixels, our visual system can tell whether p is black or white by observing 
Si (g» s 2 . 

Note that Si (or S 2 ) in Table 3.1 is not a single pixel, but two subpixels. We 
call si (or S 2 ) an extended block and the pair (si, S 2 ) the pair of two extended 
blocks with respect to p. The number of the subpixels in each of the two 
extended blocks (si, S 2 ) for encoding p is referred to as the pixel expansion. 
In Table 3.1, the pixel expansion is 2. In realistic implementations, it may be 
chosen as 4 (= 2 x 2) in order to retain the aspect ratio of the original secret 
image. Since there are six possible patterns for a 2 x 2 extended block, all 
pairs of two extended blocks (si, S 2 )’s for encoding a specific binary pixel p 
(visual one-secret sharing) are summarized in Table 3.2. 

When p is white (black), the dealer randomly chooses one of the first (last) 
six rows of Table 3.2 to encode p into si and S 2 . It is seen from the last column 
of Table 3.2 that the reconstructed pixel r = Si ® S 2 may contain two white 
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TABLE 3.1 

Encoding a binary pixel p into two shares 
si and s 2 . 


p probability 

Sl s 2 

Sl (g) s 2 

1/2 

E 1 

n 

1/2 

1 1 

a 

■ 1/2 

M i 

■ 

■ 

1/2 

a e 

■ 


TABLE 3.2 

Implementing the visual one secret sharing 
scheme with a pixel expansion of 4. 

p Probability 

Sl 

s 2 r = 

= Sl (g> s 2 

1/6 

a 

a 

a 

1/6 

n 

n 

n 

1/6 

a 

a 

a 

□ 

1/6 

- 

- 

B 

1/6 

H 

H 

5 

1/6 

■■ 

■■ 

a 

1/6 

i 

a 

■ 

1/6 

H 

- 

■ 

1/6 

a 

E 

■ 

■ 

1/6 

- 

n 

■ 

1/6 

H 

■■ 

■ 

1/6 

■■ 

H 

■ 
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and two black subpixels if p is white, or all four black subpixels when p is black. 
When all pixels in p are encoded in this way, where each p's random choice 
for encoding alternatives is independent, the encoded shares Si (containing 
all si’s) and S -2 (containing all S 2 ’s) are indeed random pictures, respectively. 
When Si and S 2 are superimposed, all of the four subpixels are black in 
the reconstructed blocks corresponding to each black pixel in P, while two 
subpixels are white and the other two are black corresponding to each white 
pixel in P. Based upon such a difference, our visual system recognizes the 
white and black pixels in P from Si (g> £ 2 . We say that the reconstructed 
image SI ® S 2 recovers P. 

Figure 3.1 shows the implementation results of the encoding scheme in 
Table 3.2. Figure 3.1(a) is a secret binary image P, Figures 3.1(b) and (c) 
are the two encoded shares Si and S 2 , which are random pictures revealing 
no information about P and Figure 3.1(d) illustrates the reconstructed image 
Si ® S 2 that recovers P visually. 



FIGURE 3.1 

Implementation results of visual one-secret sharing in two shares: (a) P, (b) 

Si, (c) S 2 , (d) Si®S 2 . 
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3.3 Visual Two-Secret Sharing Schemes 
3.3.1 Wu and Chen’s Scheme 

Following the research of Naor and Shamir, Wu and Chen [12] developed a 
visual secret sharing scheme that encrypts two secrets into two shares. Given 
two N x N (square) secret binary images Pi and P 2 , their scheme produces 
two shares, namely Si and S 2 , which reveal no information about Pi or P 2 
individually. Yet when stacking Si and S 2 , we obtain Pi visually; moreover, 
when stacking Sf°° and S 2 , we see P 2 . 

Consider a pair of pixels pi = P\[i,j] and P 2 = P 2 [u,v\ in Pi and P 2 , 
respectively. We refer to (pi, P 2 ) as the corresponding pixels of Pi and P 2 if 
and only if i = u and j = v. Given a set of corresponding pixels (j>\, p 2 ),Wu 
and Chen’s encoding scheme for visual two-secret sharing in two shares is 
summarized in Table 3.3. 

It is seen from Table 3.3 that each pair of corresponding pixels (pi, P 2 ) of 
(Pi, P 2 ) is encoded into extended blocks si (as well as sf 0 ) and S 2 in which 
the pixel expansion is m = 4. Note that s® 0 is exactly the result of rotating 
Si 90° counterclockwise. We explain how Wu and Chen’s encoding scheme 
works by using a simple example. Assume that the two secret images Pi and 
P 2 are composed in a square of 12 x 12 pixels. Then, the two encoded shares 
Si and S 2 are composed in a square of 48 x 48 (48 = 12 x 4) pixels. They 
first decompose S 1 into four triangle-like areas with an equal size as shown 
in Figure 3.2(a). All of the four areas are composed of an equal amount of 
extended blocks (2x2 pixels each), which are indexed as shown in Figure 
3.2(b) where each triangle-like area contains 36 blocks. Let block j in area k 
be denoted as bj for 1 < k < 4 and 1 < j < 36. The extended blocks in area 
I, bj, are randomly selected out of those in Figure 3.2(c). Each block, say 6), 
in area II, III, IV is assigned to be the same as in area I, that is, 6) = 
for t = 2, 3, 4, and 1 < j < 36. 

Let us pay attention to the four pixels at the top-right, top- left, bottom- 
left, and bottom-right corners in sequence (counterclockwise) in Pi and P 2 . 
Assume that those pixels in Pi (P 2 ) are (□,■,□,■) as shown in 

Figure 3.3(a) and (Figure 3.3(b)). Assume that corresponding block b\ & at S 1 

is randomly determined as ^1, then as mentioned b^Q is for 2 < t < 4 (see 
Figure 3.3(c)). The above-mentioned pixels in Pi and P 2 constitute four sets 
of corresponding pixels: (□,□), (□,■), (■,□), and (■,■). Since b% 6 in Si is 


for 1 < k < 4, according to Table 3.3 the four blocks b \ 6 , 6| 6 , b^g and 6 , 

in S 2 with respect to the four sets of the corresponding pixels are a.a, 

H and E , respectively (see the 2nd, 6th, 10th, and 14th rows in column S 2 
of Table 3.3). Figure 3.3(d) illustrates the encoding result of S 2 . As expected, 
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TABLE 3.3 

Wu and Chen’s encoding scheme for visual two-secret sharing 
in two shares. 


Pi 

P 2 Probability 

90° 

Si Sf U S 2 

Si ® s 2 

S?°° fg ) s 2 


1/4 

LJ. 
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„ 1/4 

a a a 
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□ 

1/4 

in 
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(a) 



l jir 


FIGURE 3.2 

Encoding Si in Wu and Chen’s scheme: (a) Four triangle-like areas, (b) In- 
dexing the blocks in each of the four areas, (c) Blocks to be assigned. 


the four corners in the above-mentioned order in Si ® S 2 reveal □ 
respectively (see Figure 3.3(e)) to our visual system. When Si is rotated as 
Sf° as indicated in Figure 3.3(f), where all blocks are in the form of sf 0 , the 
four corresponding corners in S®°° (g> S 2 recover respectively (see 

Figure 3.3(g)). It is not hard to see that by encoding all pixels in Si and S 2 
with respect to the corresponding pixels in Pi and P 2 according to Table 3.3, 
Pi and P 2 can be recovered by Si ® S 2 and Sf 0 ® S 2 , respectively. 

Note that Si and S 2 are in the shape of squares of the same size. Si (g> S 2 
reveals Pi, while Sf (g> S 2 reveals P 2 . Wu and Chen set 9 to be 90°. It is easy 
to extend their idea to design 6 as one of 90°, 180°, or 270°, but the other 
degrees are infeasible. This is because the rotated Si (S®) cannot be aligned to 
S 2 pixel by pixel when 9^0°, 90°, 180°, or 270°. Except for the fact that it is 
restricted, there is another pitfall in their scheme: since the encoded pixels in 
each of areas I, II, III, and IV in Si are exactly the same, Si is not a random 
picture. In fact, only 1/4 shares of Si are purely random pictures. 


3.3.2 Wu and Chang’s Scheme 

Based upon the idea of Wu and Chen [12], Wu and Chang [13] devised an- 
other visual two-secret sharing scheme that allows the rotation angle to be an 
arbitrary one between 0° and 360° by adopting circle shares. Given an angle 
and two secret images Pi and P 2 , their approach produces two circle shares A 
and B such that any single A or B is a seemingly random picture that leaks 
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nothing about P\ or P 2 ; while A®B reconstructs P\ and A~ e <g>B recovers P 2 
where A~ 6 denotes the result of rotating A 0 clockwise. Note that A~ e <g> B 
is equivalent to A® B e . Intuitively, it is reasonable to choose circles as the 
encoded shares since they ease the correct alignments between A and B as 
well as A~ e and B pixel by pixel where 0° < 6 < 360°. 

They deliberately decomposed circle share A into 360 0 /6 areas where each 
area contains an equal amount of 2 x 2 sector blocks. Figure 3.4(a) shows 
the four typical patterns for sector blocks, namely s}, sf, sf, and s f, used in 
their approach. That is, the whole circle share A is composed by all these four 
sector blocks. Note that s( (sf, sf, sf) can be consciously regarded as the 
result of rotating sf (sf , sf, sj , respectively) 90° counterclockwise (or sf can 
be consciously regarded as the result of rotating 90° clockwise). We say that 
s}’s (sf’s, sf’s, sf’s) previous sector block is sf (sf, sf, sf, respectively) and 
its next sector block is sf (sf, sf, sf, respectively) as summarized in Figure 
3.4(b). 


(a) 

(b) 




El - 



prev(s) s x 4 Sj 1 sy 2 sy 3 
next-(s) Si sf 3 s-p s/ 


FIGURE 3.4 

2x2 sector blocks for A in Wu and Chang’s approach: (a) 2 x 2 sector blocks 
for A, (b) prev(s) and next(s) of sector block s. 

Let the number of areas in circle share A be a(= 360° /ff) and the number 
of sector blocks in each area be (3. These a areas are indexed clockwise. Let of 
be the jtli sector block in area k in A, 1 < j < [3 and 1 < k < a. At first, the 
(3 sector blocks in the first area are randomly selected out of those in Figure 
3.4(a). Then, sector blocks in area t are defined according to those in area 
t— 1 by assigning a* as the next sector block of a*. , i.e. , a* = next(af -1 ) (or 

a* -1 = prevfafj)) for 1 < j < fj and 2 < t < a. 

Given a pair of corresponding pixels p± and P 2 in Pi and P 2 , respectively, 
each sector block b J in B is determined by pi, P 2 , and the corresponding block 
a k j in A for 1 < j < (3 and 1 < k < a. Table 3.4 summarizes such an encoding 
scheme. 

Note that in Wu and Chen’s scheme each extended block S 2 in S 2 would 
be superimposed with Si and sf 0 when Si is rotated 0° (or fixed) and 90° 
counterclockwise, respectively. In Wu and Chang’s scheme, each sector block 
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TABLE 3.4 

Wu and Chang’s encoding scheme for visual two-secret sharing in 
two shares. 

Pi P2 Probability Si s / 0 S2 Si < 8 > s 2 s / 0 < 8 > s 2 

1/4 ^E/ ^3 ^3 ^3 

□ □ 1/4 uu cB lB ^B 

. J J J 

1 V V V 

1/4 E 1 GK 

1/4 fflUB I! 

Bar & 

ij j 

BBS! S 

naaia 

V - I. ■ B 

ttEE ■ B 





enaii 

B3GII 

afflB ■ ■ 

9G9II 
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bj in B is superimposed with a k in area k and a k 1 in fc’s previous area 
k — 1 when A is rotated 0° and 9 clockwise where a = prev(a k ) (or a* = 
next(a k j~ 1 )) . Note that a^ 1 is the result of rotating a k 90° counterclockwise 
(or a k is the result of rotating a^ 1 90° clockwise; see Figure 3.4). That means 
the result of A~ e <8 B in Wu and Chang’s scheme emulates that of Sf°° (8 S 2 
in Wu and Chen’s scheme. There is no restriction for 9 to be 90°, 180°, or 
270° merely. Yet there exist some inconsistent situations in some of the areas 
in A~ 9 <8 B when a = 360 °/6 > 4. Interested readers refer to Ref. [13] for 
details. 

As mentioned above, square share S± in Wu and Chen’s scheme is not 
a totally random image. Strictly speaking, neither is circle share A in Wu 
and Chang’s scheme due to the reason that sector block a* is assigned as 
next(a t j _1 ) (i.e., the result of rotating a ‘- -1 90° clockwise) for 2 < t < a; that 
is, only sector block aj in the first area is randomly determined from those 
in Figure 3.4(a) for 1 < j < /?, while the other areas are not. Furthermore, 
sector blocks in the first area of circle share A (see Figure 3.4(a)) in Wu and 
Chang’s scheme (or extended blocks in the first area of square share Si (see 
Figure 3.2(c)) contain only four patterns, instead of six, which is the number 
of all possible combinations for four subpixels with two white and two black 
subpixels (see Table 3.2). 


3.4 Visual Multiple-Secret Sharing Schemes 

Both of the above-mentioned schemes accomplish visual secret sharing for 
only two secrets in two shares. In this section we discuss two more generalized 
visual secret sharing scheme for x > 2 secrets in two shares by Shyu et al. [8] 
and Feng et al. [3] in Sections 3.4.1 and 3.4.2, respectively. 

3.4.1 Shyu et al.’s Scheme 

3. 4. 1.1 Informal Description 

Let us start by using a simple example. Assume that the number of secret 
images to be shared is x = 3. Let Pi, P 2 , and P 3 be the three binary secret 
images with the same size h x w. Let p\ 1 p 2l and p 3 denote the corresponding 
pixels in Pi, P 2 , and P 3 , respectively. Let A and B denote the two circle shares 
encoded by the scheme. Our aim is to assure A <8 B recovers Pi, A 120 <g> B 
recovers P 2 , and A 240 ° <8 B recovers P 3 . 

Since there are three secrets, we decompose circle share A and B into three 
(x = 3) chord-areas ( chords for short), respectively, in which the angle of each 
chord extends up to 120°(= 360°/x = 360°/3). Each chord is divided into a 
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set of 2 x 3 (2 x i) chord blocks. Let the number of 2 x 3 blocks in each 
chord be (3. Let a* and b k denote block j of chord k in A and B , respectively, 
1 < j < 8 and 1 < k < 3(= x). The chords are indexed clockwise and the 
divided blocks in A and B are indexed as shown in Figures 3.5(a) and (b), 
respectively. We call a k and b k the corresponding blocks in A and B. 

3. 4. 1.2 Encoding Circle Share A 

We first define three 2x3 elementary blocks, namely s\, s\, and s^, for circle 
share A as shown in Figure 3.6. That is, these elementary blocks are the basic 
constituents of A and there are one white and five black subpixels in each of 
the elementary blocks. 

In order to guarantee the randomness when using s k A as a constituent of 
A for 1 < k < 3, we permute the subpixels within s A before assigning s A as 
a constituent block in A. Let E = (ay, 02, 03, <74, 175, erg) be a permutation of 
1, 2, 3, 4, 5, 6 (in which 6 = 2x = 2 x 3). We define a function permute{s, E) re- 
arranging the subpixels in elementary block s by permutation E. Figure 3.7(a) 
shows a certain typical ordering of the subpixels in a 2 x 3 elementary block s 
and Figure 3.7(b) shows the result of permute(s, E) with E = (3, 5, 1, 6, 2, 4). 
Note that the order of the subpixels in the elementary block s can be defined 
arbitrarily. 

We call the set of three blocks (a], a 2 , a^) the related blocks of the three 
chords in A for 1 < j < (3. Obviously, there are totally j3 sets of the related 
blocks in A. For a certain set of related blocks (a], a 2 , a|), we generate one 
permutation, denoted as E j, and assign a k to be perrrmte(s A , E j) for 1 < k < 
3 and 1 < j < [3. That is, 

(a],a|,a^) = {permute{s 1 A ,'Bj),permute{s s A ,Y,j),permute{s\,'Bj)) (3.1) 
for 1 < j < (3. 

For the purpose of illustration, we show how the first set of the related 
blocks (a\, a 2 , af) in A is encoded. Assume that Ei = (1, 2, 3, 4, 5, 6). Figure 
3.8(a) exposes the results of encoding (aj , a 2 , af) in A. Note that for this 
particular Ei permute(s A , Ei) = s A for 1 < k < 3. In real implementation, 
a new random permutation E ; - is adopted when encoding (aj,a|,a|) in A for 
each j , 1 < j < (3. Figures 3.8(b) and (c) show the results of A 120 ° and A 240 ° , 
respectively. 

Let [k,j] denote the absolute location with respect to block j of chord k in 
a circle share (see Figure 3.9) and A e [k,j) denote the content of block [k.j] in 
A 9 (i.e., the results of rotating A 0 counterclockwise) where 1 < k < 3 (= a;), 
1 < j < 0 and 6 = 120°(= 360°/3)(A o °[fc, j] = A[k,j]). The relationship 
among the related blocks is easily seen from Figures 3.8 and 3.9: 
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at u wl 

(a) (b) (c) 

FIGURE 3.6 

Elementary blocks for circle share A for sharing 3 secrets: (a) . (b) S%, (c) 


(a) 


Cl 

2 

17 

\L 

5 

17 


(b) 


FIGURE 3.7 

Subpixels in 2 x 3 elementary block s and permute(s, E): (a) a certain ordering 
of the subpixels in s, (b) the ordering of those in permute(s, E) where E = 

(3, 5, 1,6, 2, 4). 


A[lJ\=a), A 120 °[l,j] = a?, A™°[l,j\ = a* 

A[2,j\=a), A™°[2,j\ = a], A™°[2,j] = a] 

A[3,j]=a 3 j , A™°[3,j) = a), A uo °[3,j] = a) (3.2) 

for 1 < j < 0. 

3. 4. 1.3 Encoding Circle Share B 

First of all, with regard to the three given hxw secret images Pi, P 2 , and P 3 , 
we divide Pi evenly into 0 = h x (w/ 3) = h x ( w/x)strips . Let (pi)j denote 
the jth pixel of strip k in P, and (pi,P 2 ,P 3 )) = ((pi)j, (P 2 )*, (P 3 )*) be the jth 
corresponding pixels of strip k for (Pi , P 2 , P 3 ) where 1 < j < 0 and 1 < i, 
k < 3. Each block, say bk, in B is determined according to the related blocks 
(a* , a 2 , a*) in A and the corresponding pixels (pi,P 2 ,P 3 )j in (Pi , P 2 , P 3 ) for 
1 5: j < /? and 1 < k < 3. 

Consider a particular block 6 j in the first chord of B. Note that the cor- 
responding block aj (a? and a|) in A (4 12 ° J and 4 240 °, respectively) is a 
permuted result of elementary block s 3 i ( s a and s a> respectively) according 
to E j, which is decided in run time. The encoding scheme for before run 
time is essentially based upon (s^, s\, s\) and (pi,P 2 ,P 3 )) as summarized in 
Table 3.5. 

It is observed from Table 3.5 that given a set of corresponding pixels 
(Pi,P 2 ,P 3 ), the results of ® s B (s^ < 8 > s B , ® s B ) reveals pi (p 2 , P 3 , 
respectively) to our visual system. For instance, consider the third row of 
Table 3.5 where (pi,P 2 ,P 3 ) = (□, ■, □)• When the related blocks in A are in 
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FIGURE 3.8 

Encoding the first three blocks in each of the three chords by Ei in A: (a) A, 
(b) A 1200 , (c) A 2i0 °. 
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FIGURE 3.9 

Absolute location of block [1, j], [2, j], and [3, j\. 


TABLE 3.5 


Encoding a set of corresponding pixels (p\iPi,Pz)) into aj (a'j and aj) 
and in terms of (s^, respectively) and sg in the first chords of 
A and B, respectively for visual 3-secret sharing. 


Pi 

P2 

P3 

1 9 9 

S A S A S A S B 

s J <8> SB 

S A 2 ® SB 

sj ® SB 

□ 
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□ 

□ 
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0 

m 
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BB 

□ 

■ 

□ 

n 

jb 

BB 

BL 

□ 

■ 
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JB 0 Bb 1 SB 

JB 

BB 

BB 
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□ 

H 
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m 
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□ 
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W 

BB 
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w 

bb 

BB 

m 

■ 

■ 

■ 
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their elementary forms s^, s\, and s A , we design sb to be W so that both 
s A ® s b and Sb reveal one white and five black subpixels, while s A <S> Sb 
show six black subpixels. Our eyes recognize 0 sb and s\® sb as white, 
while s A 0 sb as black. That means {pi,P 2 ,Ps) is recovered by (s^ 0 sb, 
s 2 a ® sb , 4 0 Sb) in a visual sense. 

In actual implementation, the set of three related blocks (a], a 2 , a)) in A is 
deliberately assigned as ( permute{s A , E j),permute{s 2 A , T,j),permute{s A , E_,-)) 
so that we only need to assign b) to be permute{s b , E j) to preserve the su- 
perimposition results designed in Table 3.5. Then, when we superimpose a) 
and bj, we identify (pi)) form a] <g> b). When we rotate A 120° counterclock- 
wise, bV s corresponding block in A 120 ° turns out to be a 2 (i.e. , A 120 °[l, j], 
see formula (3.2) and Figure 3.9) and a 2 0 b) reveals {P 2 )) in a visual sense. 
Likewise, when rotating A 240° counterclockwise, b)’s corresponding block in 
A 240 ° is a) and a) 0 ) b) reveals (^ 3 )]. In general, when rotating A {i — 1)0 
counterclockwise we recognize a) 0 as {.Pi)) in the first chord of A^~ 1 ' )9 0 B 
by our visual system for 1 < i < 3(= x) and 9 = 120°(= 360 o /s). 

We call the blocks in column sb of Table 3.5 the elementary blocks cir- 
cle share B for sharing 3 secrets, which consists of three white and three 
black subpixels. They are named by 4; 4; . . . , s" B in sequence as indicated 
in Figure 3.10. When we denote □ as 0 and ■ as 1, the superscript l of 
s l B is equal to the code formed by P 1 P 2 P 3 in binary, i.e. I = btod{pip 2 Ps) 
where btod{b) is a function that returns the decimal representation of a bi- 
nary number b. It means that based upon Table 3.5, once {a), a), a)) is 

assigned to be ( 4 > 4 > 4 ) an d is encoded to be s h *" d ( p ' P2P 'A ( S p ec jfj_ 
cally, {a), a), a)) = {permute{s A ,T,j),permute{s A ,T I j),permute{s A ,T I j)) and 
b) = permute{s b B ° d ( piP2P3 \Yij) in practical implementation with respect to 
give {pi,P 2 ,P 3 )), ( a ) 0 b), a 2 0 b),a j 0 b )) recovers (pi,P 2 ,P 3 ))- 


(a) 

(e) 


BiO (f) ( g ) (h) 


FIGURE 3.10 

Elementary blocks of share B for sharing 3 secrets: (a) 4> (b) s B , (c) s 2 B , (d) 
4> (e) s%, (f) 4, (g) 4, (h) 4 . 


Now, we take the instances in Figure 3.11, in which the first three pixels of 
the three divided strips in Pi are depicted for 1 < i < 3, as an example to show 
how the corresponding blocks in B are encoded. From Figure 3.11, we have 
0h>P2>P3)i = (□.■,□)■ According to Table 3.5, the elementary block for b\ 
is chosen to be = g Mod(oio) _ Since in practical implemen- 

tation, 6)’s corresponding block a\ (a 2 , af) in A (A 120 , A 240 , respectively) 
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has been encoded as permute(s\, Si) ( permute(s 2 A , Si ) , permute(s A , Si), re- 
spectively), the same permutation Si should be adopted for encoding b\ to 
preserve the superimposition result of s A ®> Sb (s' a ® Sb and s\® Sb, respec- 
tively). Let us simply set Si = {1, 2, 3, 4, 5, 6}. Therefore, b\ is encoded as 
permute(s 2 B , Si) (8S) as show in Figure 3.12. It is easily seen that 


a\ ® b\ 
a\ ® b\ 
a\ ® b{ 


permute(s A ,'Ei) ® permute(s 2 Bl Si) 

® s 2 b = JB ® SS = JB 

permute(s 2 A , Si) ® permute(s 2 B , Si) 

permute(s A ,Yli ) permute(s 2 Bl Si) 

s A <8> s 2 B = WO ® SS = BB 


n p p 


■ P P 


H P P 


(b) 


(c) 



FIGURE 3.11 

Instances of the first three pixels of the three strips in (a) Pi, (b) P 2 , and (c) 

/V 



FIGURE 3.12 

Encoding b\ in B. 

Therefore, the first blocks in the first chords of A ® P, A 120 ° ® P, and 
A 240 reconstruct (pi)\ (□), (^ 2)1 (B), and (ps)\ (□), respectively. 

In summary, given a certain (pi,P 2 ,P 3 )} in the first strips of (Pi, P2, P3), 6] 
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is encoded as permute(s b g° d ^ PlP2P3 \ Ej) where Ey is a random permutation for 
1 < j < /?• It is noted that for a specific black in the first chord of B, when 
A is rotated 0°, 120°, and 240° counterclockwise, the blocks that are super- 
imposed onto bj are aj, aj, and aj, respectively where aj = permute(s k A , E ? ) 
for 1 < j < P and 1 < k < 3. 

Now, consider a certain block b j in the second chord of B. When A 
is rotated 0°, 120°, and 240° counterclockwise, the blocks that are super- 
imposed onto bj are aj, aj, and aj accordingly (see Figure 3.9 and for- 
mula (3.2)). Thus, to recover a given set of (pi,P2,P3)j, we should assure 
that s\ g sb, g Sb, and s\ g sb (or more precisely permute(s\,T,j) (g 
permute(sB, T,j),permute(s\, E j) ®permute(sB, E j) and permute (s^, Ej) g 
permute{sB,'Sij )) resconstruct (pi)j, ( p^)j and {ps)j, respectively. Table 3.6 
is designed for this principle. 

TABLE 3.6 


Encoding a set of corresponding pixels (pi,P2,P3)j into aj (aj and aj) 
and bj in terms of s\ (s\, s\, respectively) and sb in the first chords of 
A and B, respectively for visual 3-secret sharing. 


Pi 

P2 

P3 

S A S A S B 

S A ® SB 

Sa ® SB 
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w 

WK 

WL 
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WK 

WK 

m 
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■ 
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m 
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■ 
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In fact, we can rearrange Table 3.6 to make the columns 4-10 exactly 
the same as those in Table 3.5. Table 3.7 is such a consequence. Note that 
Tables 3.5 and 3.7 are the same except for the headings of columns 1-3. From 
Table 3.7, we observe that given a set of corresponding pixels (jpi,P2,Ps)j, the 

elementary block of bj can be easily determined by s bbo A p3Plp A _ 

Following the above example shown in Figure 3.11, we have (pi,P 2 ,P 3 )j = 
(■,■,□) and Ei = (1, 2, 3, 4, 5, 6, ). Since btod(pzPiP2) = btod( 011) = 3 bj is 
encoded as permute(s 3 B , Si) (SB) as show in Figure 3.13. It is easily seen that 
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TABLE 3.7 

Encoding scheme equivalent to Table 6 for the second chords of A and B 
for visual 3-secret sharing. 


P3 

Pi 

P2 

9 9 

S A S A S A S B 

s^ 1 <8> SB 

s^ 2 ® SB 

sj* ® SB 
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a 2 <g> 

a 3 ® 6j 
a\ ® 6j 


permute(s 2 A .Yi\) <S> permute{s%,Y,\) 
s\®sl = %M®VB = m 
permute{s\,H\) <g> permute(s 3 Bl T.\) 
s a®s% = W®SB = W 
permute(s\, £i) ® permute{s i B . £i ) 
S A ® S s = ® 



FIGURE 3.13 

Encoding 6 2 in B. 

That is, a 2 ® bj, a? ® and a] ® 6? (the first blocks in the second chords 
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of A 0 B, A 120 ° 0 B , and A 240 ° 0 B) reconstruct (pi) 2 (■), (P 2 )? (■), and 
(p 3 )l (□), respectively. 

Based upon the experience above, Table 3.8 summarizes the encoding 
scheme for the blocks in the third chord of B for sharing 3 secrets. We can 
see from Table 3.8 that given a set of corresponding pixels (jpi,P 2 ,PsYji the 
elementary block of b | is chosen to be s b ^ od< ' P2P3Pl \ 

TABLE 3.8 


Encoding a set of corresponding pixels (pi,P 2 ,P 3 )^ into a 2 (a] and a 2 ) 
and bj in terms of (s\, s\, respectively) and sb in the first chords of 
A and B , respectively for visual 3-secret sharing. 


P2 

P3 

Pi 

4 S A S A S B 

sj <S> s b 

•4 0 SB 

si 0 SB 

□ 
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Following the previous example in Figure 3.11, consider the particular case 
{pi,P 2 ,P 3 )i = (□,■,■). Since btod{p 2 P 3 p\) = btod( 110) = 6, we encode b\ as 
permute(s 6 B ,'£i) (SB) as show in Figure 3.14. It is clearly seen that 


a\ 0 b\ 
a\ 0 b\ 
a\ 0 b\ 


permute(s\,'Ei) 0 permute(s%,Y>i) 

4 ® 4 = ® ® 

permute(s\,'E 1 ) ® permute(s e B , Si) 

0 sg = 31 0 B S = W 

permute(s\,Y*i) 0 permute(s%,'£i) 

40 4= W 0 BS = W 


We have that af 0 bf, a\ 0 b\ , and a\ 0 b\ (the first blocks in the third 
chords of A&B, T 120 ° 0B, and T 240 ° 0B) recover (pi)f (□), (^ 2)1 (■), and 
(p 3 )i (■), respectively. 

Figure 3.15 depicts the results of the first three blocks in the three chords 
of A 0 B, T 120 ° 0 B and A 240 ° 0 B, which reconstruct (pi)i in P\ (□, ■. □) 
(Figure 3.15(a) vs. Figure 3.11(a)), (p 2 )i in P 2 (■,■,■) (Figure 3.15(b) vs. 
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FIGURE 3.14 
Encoding b\ in B. 


Figure 3.11(b)) and (^ 3)1 in P 3 (□,□,■) (Figure 3.15(c) vs. Figure 3.11(c)), 
respectively for 1 < k < 3. 



FIGURE 3.15 

Results of (a) A ® B, (b) _A 120 ° <g) B. and (c) A 2i0 ° ® B. 


Based upon the above discussions, we obtain b k - = permute(s l B , Ej) where 

{ btodfpip^pi) if k = 1 ; 
btod(p2p\p2) if k = 2 ; 
btod(j> 2 P 2 P\) otherwise, 

for the given set of corresponding pixels (pi,P 2 ,P 3 )j with respect to pixel j of 
strip k in (Pi, P>, P 3 ) where 1 < j < /3 and 1 < k < 3. 

Let rotate(r\r 2 . . .r x ,d) denote a function that rotates r\r 2 - ■ .r x right d 
bits where £ {0, 1 }, 1 < i < x and 0 < d < x — 1 ; that is, 


rotate{r\r 2 . . .r x ,d) 


rir 2 ...r x 
if d = 0 ; 

Lr-d+i Lr-d +2 . . . r x ri r 2 . . . r x _ d 
otherwise (1 < d < x — 1 ). 


(3.3) 
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Then the above formula can be simplified as 

b k = permute{s b * od(rotate{piP2P3 ’ k - 1) \ £,) (3.4) 

with respect to the set of corresponding pixels (pi,P 2 >P 3 )j where 1 < j < 0 
and 1 < k < 3. 

Since the number of subpixels in both of the elementary blocks of A and B 
is 6(= 2x) in the above case, the pixel expansion (i.e. , the number of subpixels 
in the shares needed to encode a set of corresponding pixels in the secret 
images) in this algorithm is 6 for x = 3. The visual x-secret sharing scheme 
for any general number x > 2 will be formalized in the following section. 

3.4. 1.4 General Algorithm 

The definitions of the elementary blocks for circle shares A (formula (3.1)) 
and B (formula (3.4)) and the encoding scheme in Tables 3.5, 3.7, and 3.8 for 
visual 3-secret sharing can be generalized to accomplish the visual multisecret 
sharing for x > 1 (including x = 1) secrets. Furthermore, there is no need to 
store any codebook like Tables 3.5, 3.7, and 3.8. Thus, this scheme formally 
presented in the following is not only general but also efficient for physical 
implementation. 

Assume that there are x secrets to be shared by two participants. The two 
circle shares A and B are evenly decomposed into x chords, respectively. Let 
9 denote the degree expanded in each chord of A and ^3. It is computed as 

9 = 360°/x. 

We refer to the elementary block of the x secrets as a block with 2x ordered 
subpixels as shown in Figure 3.16. It is noted that the pixel expansion in 
the scheme is 2x when x secrets are shared. The width and height of the 
elementary block can be any combination as long as their multiplication is 
2x (or even any number larger than 2x for some special purposes, such as 
retaining aspect ratios, to ease the production of the circle shares, and so on). 
The order of the 2x subpixels in the elementary block can also be arbitrarily 
defined. In the following discussions, we follow the shape and order of the 
elementary block as shown in Figure 3.16. 



FIGURE 3.16 

Elementary block for x secrets. 

We define the set of the elementary blocks for share A as follows: 
E x A = {s k A \l<k<x}, 
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where s k A is an elementary block consisting of one white and 2x — 1 black 
subpixels in which the jtli subpixel, denoted as s k A [j], is defined by 


i[j] = 


0 if j = x + 1 — k- 

1 otherwise, 


(3.5) 


for 1 < j < 2x and 1 < k < x. 

Figure 3.17 shows the elementary blocks of A for encoding x = 4 secrets. 
As an example, we show how the subpixels in s A are computed by formula 
(3.5). Since k = 2 and x + 1 — fc = 4+ 1 — 2 = 3, thus s^[3] = 0 and s k A [j'} = 1 
for 1 < j' ^ 3 < 8(= 2x) as shown in Figure 3.17(b). 


FIGURE 3.17 

Elementary blocks in E A : (a) s^, (b) s A , (c) s^, (d) s A . 


We define the set of the elementary blocks for share B as follows: 


E% = {sl |0 < 7 < 2 * - 1 }, 

where 4 is also an elementary block containing x white and x black subpixels 
in which the jth subpixel, denoted as s] 3 [j], is defined by 


Aj] 


rj 1 < j < x; 

r 2 X +i-j otherwise, 


(3.6) 


where 7 = btod{r x r x -\ . . . ran ), r* is the fth least significant bit of 7 is repre- 
sented in binary (:r-bit) in which 1 < t < x and 0 < 7 < 2 X — 1 for 1 < j < 2x 
and r t is the inverse of r t . 

Figure 3.18 illustrates the elementary blocks of B for x = 4. Con- 
sider Sg. Since 7 = 4 = btod{r 4 r^r 2 r\) = btod( 0100)2, we have 
( s b[ 1 ]> s b[ 2 ]) s I?[ 3 ] i s b[ 4 ]) = {n,r 2 ,r 3 ,r 4 ) = (0,0, 1,0) and (s|[5], s|[6], 

s b[ 7 ] ; s b[ 8 ]) = (^2x4+1-5U2x4+1-6,F2x4+1-7,F 2 x 4+1-8) = (^4, F 3 , f 2 , Fi) = 

(1,0, 1,1). Thus, 4 is as shown in Figure 3.18(e). 

Formulae (3.1) and (3.4) about the encoding of blocks in A and B , respec- 
tively, for x = 3 can now be formulated in a more generalized form as follows. 
The blocks in A are encoded by 


(a], Oj, . . . , a|) = (permute(s A , T, j) , permute(s‘ A: E^-), . . . ,permute{s x A , E^)), 

(3-7) 

where Ej is a random permutation of {1,2 ,..., 2x} for 1 < j < (3. 

Given a set of corresponding pixels (pi,p 2 , . . . ,p x ) k in block j of strip k in 
(Pi, P 2 , . . . , P x ), b k (i.e., block j of chord k in B) is encoded by 

b k = permufe(4 tod(rotate(piP2 - E,) (3.8) 
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bb bss -% ah* 

(a) (b) (c) (d) (e) (f) (g) (h) 

gb fWf « h» wv ws 


(i) 0) (k) (1) (m) (n) (o) (p) 


FIGURE 3.18 

Elementary blocks in E%: (a) s° B , (b) 4> (c) s%, (d) s%, (e) s|, (f) 4> (g) 

4. (h) 4 (i) 4. 0) 4> ( k ) 4> (!) 4> H 4> ( n ) 4> (o) 4 (p) 4 

for 1 < j < /3 and 1 < fc < a; where function rat.ote(piP 2 ■ ■ -p x , k — 1) is defined 
by formula (3.3). 

Based upon the above definitions and formulae (3.5)-(3.8), our visual 
multi-secrets sharing scheme is formally presented in Algorithm 1. 

Algorithm 1. Encoding x secret images into two circle shares 

Input: x h x w binary secret image Pi, P 2 , . . . , P x 

Output: two circle shares A and B such that any single A or B leaks no 
information about any one of the secret images, while A 0 B recovers I\ 
for 1 < i < x in the human visual system where 9 = 360° /x and A 0 

1. Create A and B as circle shares, which are decomposed into x chords 
where each chord is composed by (3 = h x (w/x) chord-shaped blocks 
referred to as a* and &jf, 1 < k < x and 1 < j < (3, respectively and each 
block contains 2x subpixels. 

2. Generate and E B according to formulae (5) and (6), respectively. 

3. for (each block j, 1 < j < P) do 

3.1 { Determine E 7 - = (cti, cry, ... , cr 2a; ), a random permutation 

of {1,2 ,..., 2x} 

3.2 for (each chord k, 1 < k < x) do 

{ // all (3 blocks in x chords of A and B adopt the 

same permutation Ej 
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3.2.1 a k = permute(s A ,T,j) 

3.2.2 for (each secret image i, 1 < i < x) do qi = ( pf) k - 

3.2.3 7 = btod(rotate(qiq 2 . . .q x ,k — 1)) 

3.2.4 b* = permute{s 1 B ,Y.j) } 

} 

4. output(A, B) /I A and B are composed by all a*”s and b k, s, respectively 

Note that a new permutation E j is determined to permute the subpixels 
in each pair of a k and b k for 1 < k < x to ensure the entire randomness that 
the subpixels in a k and bj can provide. Further, a k j and b k are encoded by 
using the same permutation E j so that the numbers of the white and black 
subpixels in a k ® b k and s k A ® b ^ are exactly the same for 1 < k < x. 

The pixel expansion of Shyu et al.’s scheme is 2x when x secrets are shared. 
In the case of x = 2, the pixel expansion is 2x = 4 which is the same as that of 
Wu and Chen [12] as well as Wu and Chang [13]. The number of all possible 
patterns in an extended block in Si [12] (see Figure 3.2(c)) or any sector 
block in A [13] (see Figure 3.4(a)) is 4, which contains two white and two 
black subpixels, while that in b k of the scheme is (4!) / (2! x 2!) = 6. The 
randomness of this scheme, in the case of x = 2, is surely better than that of 
Wu and Chen as well as Wu and Chang. 

It is seen from Algorithm 1 that we do not physically store any information 
about Tables 3.5, 3.7, and 3.8 in memory. The elementary blocks s k A s and s^’s 
are generated in the run time (Step 2 in Algorithm 1) according to formulae 
(3.5) and (3.6). The encoding process is guaranteed by formulae (3.7) and 
(3.8) (Step 3 in Algorithm 1). 

3.4.2 Feng et al.’s Scheme 

Regarding Feng et al.’s (2, 2, x) scheme [3], x secret images P[. P- 2 , ■ ■ ■ , P x are 
encoded into two shares A and B. Each set of x corresponding pixels (in x 
secret images) is encoded into two blocks, namely s A £ A and sb £ B , each 
of which consists of x rows containing 3 pixels each. The pixel expansion is 
thus 3a;. The rotation relationship for revealing each of the x secrets is similar 
to Shyu et al.’s scheme where the Ah secret is revealed by A <g) for 

1 < i < x. One special design in their scheme is that the encoded shares are 
in the form of cylinders to avoid the distortion of the revealed secrets. 

They chose four types of 3-pixel patterns, referred to as the effective block 
B e = ■ ■ ineffective block Bi= MU, white block B w = M ■ and black block 
Bb = EH to construct sa and sb ■ It is evident that Bi <g> B w = Bi <g> Bb = 
B e (g> B w = ■ ■ and B e (g> B b = 

Figure 3.19 specifically illustrated the stacked results of these chosen pat- 
terns in their scheme. 


© 2012 by Taylor & Francis Group, LLC 


84 


Visual Cryptography and Secret Image Sharing 


Be 

Be 


0 B w 
0 B b 



B, 

B, 


B u 



B h 



FIGURE 3.19 

Stacking results of the chosen visual patterns for Feng et al.’s scheme. 

Table 3.9 lists a possible set of encoded patterns for sj, sj, sj 1 , and sb', 
and their stacked results for x = 3. The reason that pi is reconstructed by 
sj ® s B is precisely explained in this table. Surely, each set of the encoded 
pattern could be permuted correspondingly to accomplish the randomness for 
the whole shares. 


TABLE 3.9 


Possible set of encoded patterns for sj;, 
stacked results for x = 3. 

„ 2 3 
b A ’ b A > 
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3.4.3 Experimental Results 

Here, we implement Shyu et al.’s visual multisecret sharing scheme due to its 
generality on the abstraction and the superiority on the pixel expansion (over 
Feng et al.’s scheme). 

We coded the program by using Borland C++ Builder (BCB) in a personal 
computer running MS Windows. Since the blocks are in the shape of chords, 
we called the embedded functions in BCB such as circle drawing, line drawing, 
flood-filling a closed area, and so on, to build the chord-shaped blocks in the 
scheme. 

Four experiments were designed to explore the feasibility and applicability 
of the visual multisecret sharing scheme. Experiment 1 verifies the correctness 
of the scheme for x = 3 where the starting position for encoding on the cir- 
cle shares are fixed as above-mentioned. Experiment 2 demonstrates that the 
scheme can be easily extended in such a way that the starting position for en- 
coding can be arbitrarily assigned. This increases the secrecy of the proposed 
scheme. Experiment 3 gives the implementation results of the visual 4-secret 
sharing scheme. Experiment 4 presents implementation results of encoding 
the shares using cylinder (instead of circle) shares. 

Experiment 1: Figure 3.20 illustrates the results of a computer imple- 
mentation of the proposed scheme for sharing three secret images. Figures 
3.20(a)-(c) are the three secrets to be shared, namely Pl, P 2 , and P 3 , respec- 
tively. Figures 3.20(d) and (e) show the circle shares A and B encoded by 
Algorithm 1, which expose no information about Pi, P 2 , and P 3 individually. 
Figures 3.20(f)-(h) reveal the superimposed results of A® P, A 120 ®P, and 
A 240 ° (g) P, which reconstruct Pi, P 2 , and P 3 in our visual system, respec- 
tively. Figure 3.20(i) gives another superimposed result, A 85 ° g) B that leaks 
no information about any of the three secrets. In fact, any result of A e ® P, 
for 0 = 0°, 120°, 240°, is merely a seemingly random picture. 

Experiment 2: The encoding processes of A and P in the algorithm start 
from the 0° position and move on in a clockwise direction (see Figure 3.5). 
However, the starting position for encoding in A (or P) can be predefined 
arbitrarily. 

Figure 3.21 shows the implementation results of using the same example 
as in Experiment 1 with a different starting starting position in P; that is, we 
encoded P by starting from the 85° position (85° counterclockwise to the 0° 
position) while we encoded A by starting from the 0° position as mentioned. 
The three secret images are the same as those in Figures 3.20(a)-(c). Figures 
3.21(a) and (b) are the circle shares A' and P' encoded by Algorithm 1. Figure 
3.21(c) shows the result of A! g> P', which reveals nothing about the secrets, 
while Figures 3.21(d)-(f) display the superimposed results of (A') 85 ° ® P', 
(A ') 2050 ® B' and (A') 325 ° ®P' that reconstruct Pi, P2, and P3, respectively, 
in our visual system. Note that both A® P (Figure 3.20(f)) and (A') 85 ° ® B' 
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876S4S rgg..._ 

(a) (b) (c) 


SJSHYU 


FIGURE 3.20 

Implementation results for the proposed visual 3-secret sharing scheme: (a) 
Pi, (b) Pi, (c) P 3 , (d) A, (e) B, (f) A 0 B, (g) A 120 ° ® B, (h) A 240 ° ® B, (i) 
A 85 ° ® B. 
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is 85° counterclockwise away from that in A® B. 

Experiment 3: Figure 3.22 gives the implementation results of the pro- 
posed scheme for sharing four secrets. Figures 3.22(a)-(d) are the four secrets 
to be shared, namely Pi, P 2 , P3, and P4, respectively. Figures 3.22(e) and (f) 
are the encoded circle shares A and B. Figures 3.22(g)-(j) show the superim- 
posed results of A ® P, A 90 ° ® P, H 180 ° ® P, and A 270 ° (g) P that recover Pi, 
P 2 , P3, and P4 in our visual system, respectively. 

Experiment 4: One disadvantage in applying circle shares is that the 
reconstructed secrets might be distorted. This shortcoming could be easily 
refined by introducing cylinder shares. 

Suppose that we encode each set of x pixels into square blocks (instead 
of chord blocks) in Shyu et al.’s scheme. The encoded shares evolve into the 
shape of rectangles. Each of the two rectangle shares can be easily rolled 
up into a cylinder by aligning the rightmost column next to the leftmost 
one. Figure 3.23 shows an example of applying cylinder shares to reveal the 
corresponding distorted secrets where (a) and (b) are distorted reconstructed 
secrets (which are the same as those in Figure 3.22(g) and (j), respectively) 
using circular shares, while (c) and (d) are the corresponding counterparts 
using cylinder shares which avoid any distortion when exposing the secrets. 

The results in Experiments 1-4, as expected, demonstrate the feasibility 
and applicability of Shyu et al.’s visual multisecret sharing scheme. We com- 
pare the performances of the aformentioned schemes in terms of the capability 
of sharing secrets, pixel expansion, contrast, and shape of shares in the next 
subsection. 

3.4.4 Comparison and Discussions 

When we deal with x secrets, the pixel expansion of Shyu et al.’s scheme [8] 
is 2x and the contrast (i.e., the relative difference between the reconstructed 
white and black pixels in the superimposed image) of the scheme is 1/ ( 2x ) 
since all 2x subpixels in a reconstructed black pixel are black, while those 
in a reconstructed white pixel are 2x. Suppose that Feng et al.’s scheme is 
applied. The pixel expansion becomes 3 .t and the contrast is \/{2>x). Note 
that when x = 2, the pixel expansions (contrasts) in Wu and Chen’s [12], Wu 
and Chang’s [13], and Shyu et al’s schemes are all 4 (1/4); while in Feng et 
al.’s scheme is 6 (1/6). 

Table 3.10 summarizes the numbers of secrets shared (denoted as x), pixel 
expansions(denoted as to), contrasts, and the shapes of shares in these visual 
multiple-secret sharing schemes for the comparison purpose. 

The pixel expansion of Shyu et al.’s scheme [8] is 2x when x secrets are 
shared. It would be challenging to prove whether or not it is optimal. Is there 
any algorithm that improves the contrast in the scheme? It is surely worthy of 
further study. How to extend Shyu et al.’s scheme such that multiple secrets 
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FIGURE 3.21 

Implementation results for the proposed visual 3-secret sharing scheme with a 
different starting encoding position: (a) A', (b) B ' , (c) (d) (A') 85 °<g)B\ 

(e) (A') 205 ° ® B', (f) (A') 325 ° 8) B'. 
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FIGURE 3.22 

Results of computer implementation for 4-secret sharing: (a) P±, (b) P 2 , (c) 
P 3 , (d) P 4 , (e) A, (f) B, (g) A® B, (h) A 90 °®B , (i) A 180 °®B (j) A 270 °®B. 
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FIGURE 3.23 

Transforming circle shares (a) and (b) into cylinder counterparts (c) and (d), 
respectively. 


TABLE 3.10 

Comparison of visual multiple secrets sharing schemes. 


schemes 

X 

m 

contrast 

shares’ shape 

Wu and Chen [12] 

2 

4 

1/4 

square 

Wu and Chang [13] 

2 

4 

1/4 

square 

Feng et al.[3] 

> 2 

3a; 

l/3a; 

cylnder 

Shyu et al.[8] 

> 2 

2a; 

l/2x 

circle or 

cylinder 
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can be shared by more than two shares is also an interesting topic. Potentially, 
sharing multiple secrets may have more flexibilities and applications than 
sharing only one secret. Visual identification and visual authentication are 
some typical applications in visual cryptography [6]. It would be of much 
significance to reexamine these topics from a viewpoint of sharing multiple 
secrets. 

As a matter of fact, the sharing of multiple secrets visually brings forth new 
problems to be considered. For instance, with regard to the “starting position 
for encoding” in A or/ and B in Experiment 2, we may design such a concern 
to be some kind of private key, which is only accessible between the dealer and 
authorized participant(s). Without the correct starting positions in A or/and 
B , the alignment of A and B cannot recover the secret yet. In addition, the 
second secret of the three secrets in Experiment 1 might be designed to be 
fake for the purpose of diffusion. That is to say whether the whole secret 
message is “Help is never on its way” or “Help is on its way” may be treated 
to be another private key between the dealer and authorized participant (s). 
Mainly, the number of secrets, the degree of the starting position for encoding, 
the combination of the true or fake reconstructed secrets, and so on, can be 
designed as private keys to increase the level of security in the visual multi- 
secret sharing system. 


3.5 Concluding Remarks 

By adopting circle or cylinder shares, we discuss general visual secret sharing 
schemes for x > 1 (indeed, these schemes work well for x = 1) secrets in 
two shares in this chapter. The previous studies considered sharing only two 
secrets in two shares [12, 13]. Shyu et al.’s scheme can be implemented easily 
and it takes only some constant working space. All encoding information can 
be determined in run time. By introducing an independent random permu- 
tation (i.e. , E j, see formulae (3.1) and (3.4)) when encoding each pair of the 
corresponding blocks (i.e., a and b'f see Step 3.2.1 and 3.2.4 in Algorithm 
1) , the scheme ensures the maximum randomness that the subpixels in an en- 
coded block may possibly provide. For the transmitter, one machine capable of 
running the encoding scheme is needed, while for the receivers, no computing 
device is required and the decryption process is simply by the human visual 
system. The proposed scheme can be easily extended to gray-level images by 
adopting the halftone technology [4] or even color images by exploiting color 
decomposition [4] or color composition [9]. 

In traditional visual secret-sharing schemes, rectangle shares are encoded 
to conceal one shared secret. They are easily superimposed by aligning the 
rectangular corners. As compared to the rectangle shares, the circle or cylinder 
shares are relatively hard to superimpose since there are no reference points 
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to align with. Basically, the usage of the circle or cylinder shares increases the 
complexity in decoding the secrets. In practical applications, the dealer might 
add additional information in the circle shares, such as some supplementary 
points, lines, or markers, to ease the superimposition (decoding process) for 
the participants. Figure 3.24 shows one possible arrangement in the case of 
sharing three secrets as in Experiment 1. Note that circle share A has three 
markers (see Figure 3.24(a)), while B has only one (see Figure 3.24(b)) based 
upon which A, A 120 ° , and A 240 ° can be superimposed with B easily. Or, 
the dealer can deliberately organize such information as private key(s) such 
that only the legal receivers are informed how to obtain the key(s). The same 
reasoning could be applied if the cylinder shares are adopted. 



FIGURE 3.24 

Shares (based upon Experiment 1) with supplementary lines to ease the align- 
ments: (a) A with three markers, (b) B with one marker. 


Generally speaking, the use of circle or cylinder shares to convey several 
secrets discloses some new issues that have not yet been considered in tradi- 
tional visual cryptography, such as “How many secrets are there?,” “How to 
superimpose the shares (where to align with or in what rotation angles)?,” “Is 
there any fake secret(s) for diffusion?,” and so on. These concerns can be de- 
signed as a set of private keys. The consideration and distribution of these 
private keys can be further discussed. 
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4.1 Introduction 

Visual cryptography is a kind of cryptography that can be decoded directly by 
the human visual system without any computation for decryption. It usually 
prints certain images on transparencies and the secret image is reconstructed 
by simply stacking the transparencies together. Extended visual cryptogra- 
phy allows the printing of meaningful images on transparencies so that it 
can conceal the very existence of ’’secret” in the transparencies. There have 
been a lot of studies to incorporate photograph images into extended visual 
cryptography. This chapter attempts to survey the studies on extended visual 
cryptography for photograph images. 


4.2 Basic Visual Cryptography Schemes 

In order to determine basic terminology in this chapter, this section explains 
basic concepts of visual cryptography, namely, k out of n Visual Secret Sharing 
Scheme (( k,n ) VSSS), an Extended Visual Cryptography Scheme (EVCS), and 
Random Grids. 

4.2.1 (k,n) Visual Secret Sharing Schemes 

This scheme was proposed by Naor and Shamir in 1994 [31]. It generates n 
transparencies from an original secret image. The transparencies are usually 
shared by n participants so that each participant is expected to keep one 
transparency. Thus, a secret image is sometimes called a shared image. The 
secret image can be observed if any k or more of them are stacked together. 
However, the secret image is totally invisible if fewer than k transparencies 
are stacked. The images on transparencies are called shadow images. 

Each pixel of a shadow image is generated separately in the conventional 
VSSS. An original secret pixel will be transformed to n patterns of pixels 
for shadow images. These pixels on shadow images are called shares. A share 
consists of m black and white subpixels. The human visual system observes 
the average of subpixels, because they exist in close proximity. This structure 
is usually described by an n x m Boolean matrix M = [m^]. Here vriij = 0 
or 1 if the jth subpixel in the itli shadow is white or black, respectively. If 
transparencies of r shadows ii, * 2 , • ■ ■ , i r out of n are stacked in a way that 
properly aligns the subpixels, each combined share can be represented by the 
Boolean ”OR” of the corresponding rows ii,* 2 , • • • , i r in the Boolean matrix 
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BS9EBS 

FIGURE 4.1 

Six possible patterns of subpixel arrangements with 50% gray. Each pattern 
is represented as [0 0 1 1], [110 0], [0 10 1], [10 1 0], [Oil 0], [10 0 1] 
from left to right. 


M. Let M r denote the m-D vector obtained by taking the Boolean ”OR” of 
r row vectors. The gray level of a pixel combined by r shares is obtained by 
the Hamming weight H(M r ) of the ”OR”ed m-D vector M r . Users interprets 
this gray level as black if H (M r ) > t and as white if H{M r ) < t — am. Here, 
t e {1, ••• ,m} is called threshold , while the value a > 0 and the number 
am > 1 are called relative difference and contrast, respectively. 

The (fc, n) VSSS consists of two collections ofnxm Boolean matrices C w 
and Cb where any matrix in C w generates a white pixel with k or more of 
shares (rows) while a matrix in Cb generates a black pixel. The scheme is valid 
if it fulfills the following three conditions: 

1. For any M in C w , the ”OR”ed vector Mk of any k rows of M satisfies 
H(Mk) < t — am. 

2. For any M in Cb, the ” OR”ed vector Mk of any k rows of M satisfies 
H{M k ) > t. 

3. For any subset U?} of {1,2, ••• , n} with q < k, the two 

collections of qxm matrices V w and T>b obtained by extracting rows 
Hi *2, • ' ’ , iq from nxm matrices in C w and Cb are indistinguishable 
so that the collections contain the same matrices with the same 
frequencies. 

The above first two conditions are contrast conditions that k or more of 
shadow images can recover the secret image with contrast am. The recovered 
secret image is usually called the reconstructed image. The last condition is 
related to security, which implies that none can gain any information on the 
secret image by investigating fewer than k shadow images. 

Here, two parameters to and a are very important to this discussion. The 
parameter m indicates the number of subpixels in a share, which is called 
pixel expansion. Each pixel of the original secret image is represented by to 
subpixels so that the reconstructed image as well as the shadow images will 
be to times large as the original image. People would like to to be as small as 
possible. The parameter a indicates the relative difference between combined 
shares of an originally white pixel and an originally black pixel. Since it means 
the loss of contrast of the reconstructed image, people would like a to be as 
large as possible. 
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FIGURE 4.2 

An example of visual secret sharing scheme (VSSS). Two shadow images of 
random patterns (left and middle) and reconstructed secret image (right). 


Let us consider a special case of (2, 2) VSSS. Each share consists of 
4 subpixels of a 2 x 2 array in a physical implementation, where two of 
them are white and the rest two are black. The Boolean matrix of this 
scheme is 2 x 4 where each row consisting of two 0’s and two l’s repre- 
sents an arrangement of subpixels in a share. For instance, six possible pat- 
terns of shares having 50% gray as shown in Figure 4.1 are represented as 
{[0 Oil], [110 0], [0 10 1], [10 1 0], [Oil 0], [10 0 1]}. The scheme is 
accomplished by the following two collections: 

C w = {matrices obtained by permuting the columns of S w } 7 
Cb = {matrices obtained by permuting the columns of Sb } 7 

where S w and Sb are given as below: 

0 0 11 ' 

110 0 ' 

The above matrices S w and Sb are called basis matrices. Because the collec- 
tions are obtained by permutation of subpixels, each share may have randomly 
arranged two white and two black subpixels, which looks 50% gray. A pair of 
shares from C w has the same arrangement of subpixels. The combined result 
is the same pattern, which looks 50% gray. A pair of shares from Cb has the 
complementary arrangement of subpixels. The combined result consists of four 
black subpixels, which looks completely black. Figure 4.2 shows an example 
of resulting shadow images and a reconstructed secret image. The size of all 
images are 128 x 128 pixels, because the original secret image has 64 x 64 
pixels. 

The original scheme proposed by Naor and Shamir is uniform , such that 
any combined shares from q < k shadow images yield ”OR”ed m-D vector 
M q with H(AI q ) = f(q) with uniform probability distribution, regardless of 
if the matrices were taken from C w or Cb . Suppose the case of q = 1, the 
above-mentioned combined share is a single share of each shadow image. It 


S w — 


0 0 11 
0 0 11 
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means all the shadow images consist of uniformly random pattern of black and 
white subpixels. Naor and Shamir pointed out an extension of this scheme for 
concealing the very existence of the secret image. 

4.2.2 Extended Visual Cryptography Scheme 

Ateniese et al. extended the VSSS in the sense of a General Access Structure 
(GAS) [1] and extended capability. [2] A General Access Structure controls 
the qualified set of transparencies with which one can recover the secret image, 
while any k or more transparencies can reconstruct the secret image in (fc, n) 
VSSS. An extended capability is able to introduce a meaningful image as a 
shadow image which Naor and Shamir pointed out in their very first paper 
[31]. An innocent-looking image of a house, dog, or something else would be 
much less suspicious than a random-dotted image as a shadow image. 

In the Extended Visual Cryptography Scheme (EVCS), for an access struc- 
ture (r Qua |,r Forb ) on a set of n participants, the shared (secret) image can be 
recovered by any qualified set X G T Q ua ] with no trace of the shadow images, 
but any forbidden set X € r Forb has no information on the secret image. More- 
over, the shadow images are meaningful so that each participant can recognize 
the image on one’s transparency. 

Similar to the (fc, n) VSSS, an EVCS can be constructed in a pixel-wise 
manner. Since n participants share one secret image and have their own images 
in the n shadow images, we have to consider n + 1 colors, c, ci, • • • , c n € {w, b} 
where w and b stands for white and black, respectively. The value c denotes 
the color of the secret image pixel and c,; denotes the color of the original 
image pixel for i-tli participant’s shadow image. In order to realize an EVCS 
that obtains a c pixel when transparencies associated to a set X G rQ ua |, 
we need 2™ pairs of collections ofnxm Boolean matrices, {Cff'" Cn ,C^ 1 '” C "), 
one for each possible combination of white and black pixels in the n original 
images for the shadow images. 

An EVCS for an access structure (rQ ua |,r Forb ) for n participants is valid 
if it fulfills the following conditions. 

1. For any X G TQ ja | and for any c F , • • • , c n G { b , w}, the threshold t x 
and the relative difference our exist, which satisfy H(Mx ) < tx — 
a^m for any M G Cff"' Cn and H(Mx) > tx for any M G Cf ) 1 '" Cn . 
Here M\ denotes the to-D vector obtained by taking Boolean ” OR” 
of the row vectors of M corresponding to the participants in X and 
H(Mx) denotes the Hamming weight of the vector Mx- 

2. For any X = {i\, ■ ■ ■ ,i q } G r Forb and for any ci,---,c n G {b, w}, 
the two collections of q x m matrices, T> r f " Cn and 'D[( 1 "' Cr * , obtained 
by extracting rows i\, ■ ■ ■ , i q from each n x m matrix in Cff'" Crl and 
C 6 C1 '" C ”, respectively, are indistinguishable so that the collections 
contain the same matrices with the same frequencies. 

3. For any i G {1, 2, • • • , n} and any ci, ■ • • , c,_i, c i+1 , ■■■ ,c n G {b, w}, 
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it results that 


min HIM. A — max H(Mf) > asm, 
MeM b y ' mzlMu, V 

where 


M b = c^ 1 ' Ci ~ lbCi * 1 "' Cn U c^ 1 "' Ci - lt>Ci + 1 '" Cn , 

M w = Cb ci - c *- 1 «' c *+ 1 '" c n uC c 1 ...c i . 1 wc i+1 -c n ^ 

and H(Mf) denotes the Hamming weight of the i-th row vector Mi 
of a matrix M. 


The values an > 0 and as > 0 are referred to as the relative difference of 
the reconstructed image and relative difference of shadow images , respectively. 
The number asm > 1 and asm > 1 are contrasts of the reconstructed image 
and the shadow images. People would like both as. and as to be as large as 
possible. 

The first condition is the contrast condition that indicates any qualified 
set X G T Q ua | can recover the secret image. The secret image can be re- 
covered by stacking the transparencies of a qualified set, belonging to TQ ua |. 
The second condition is the security condition that states any forbidden set 
X = {ii,---, i q } £ T F or b has no information on the secret image. People can- 
not get any information on the secret image by inspecting the shadow images 
of a forbidden set. The third condition is the extended condition that im- 
plies that the shadows images are still meaningful after the original images 
are encoded. Any participant can recognize the shadow image on one’s trans- 
parency. Although the collection Mb is obtained by combining two collections 
Cl i c *- lhc *+ 1 Cn and Cff c ‘ _lbc,+1 c ", we have the same set of {M{\ only with 
one of the collections, because {Mi : M £ C!ff"' Crl } = {Mi : M £ " Cn { for 
any Ci, • • • , c n £ {&, w} and any i £ {1, • • • , n} due to the second condition. 

Here we show how to accomplish a 2 out of 2 EVCS. Each share consists 
of 4 subpixels like (2,2) VSSS. However, it contains either two l’s or three 
l’s depending on the colors of pixels of the corresponding original image, 
white or black, respectively. The scheme is given by the 4 pairs of collections 
( Cff C2 ,Cl lC 2 ), namely 8 collections C° lC2 , where c,Ci,C 2 € {b,w}. The collec- 
tions are obtained by permuting the columns of the following 8 basic matrices, 

S c ClC2 : 


C ww 

°w 

<pwb 

°w 

obw 

s™ 


0 0 11 
0 10 1 

0 0 11 
0 111 

0 111 
0 10 1 

0 111 
0 111 


oww 

^ b - 

owb 

^ b - 

obw 

^ b ~ 

obb 

^ b ~ 


0 

1 

0 

1 

0 

1 

0 

1 


0 

1 

0 

1 

1 

1 

1 

1 


1 1 

0 0 J ’ 

1 1 ' 

1 0 J ’ 

1 1 ' 

0 0 J ’ 

1 1 ' 

1 0 ' 
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FIGURE 4.3 

An example of extended visual cryptography scheme (EVCS). Two resulting 
shadow images (left and middle) and reconstructed secret image (right). 


The reconstructed pixel has 3 or 4 black subpixels if the original secret pixel 
is white or black, respectively. In this scheme, the relative contrasts are given 
as an = os = y. Figure 4.3 shows an example of resulting shadow images 
and reconstructed secret image. The size of all images are 128 x 128 pixels, 
because all the original shadow and secret images have 64 x 64 pixels. 

Ateniese et al. also pointed out some of the most important aspects of the 
extended capability [2]. One is related to the contrasts of images. A trade-off 
between two relative differences exists, an and as, in any ( k , k) EVCS as 
below: 

2 fc_1 a_R + -j-as ~ 

This means we cannot increase both contrasts of a reconstructed image and 
shadow images, a^m and asm, simultaneously. They also specified the lower 
bound of the pixel expansion m in (k, k) EVCS as below: 

to > 2 fc ~ 1 +2. 

This means we need more pixels to obtain EVCS. Although people would like 
contrasts to be as large as possible and pixel expansion as small as possible, 
there exist certain limits of them. 

4.2.3 Random Grids 

Random Grids (RG) give a very different approach to visual cryptography, 
which can keep the size of resulting shadow images to be the same as that 
of the original image. In other words, the pixel expansion of this method is 
to = 1 and no more expansion problems exist. The method is first introduced 
by Kafri and Keren in 1987 [17] and reinvestigated by Shyu in 2007 [37]. A 
random grid R is defined as a two-dimensional array of pixels. Each pixel is 
either transparent (white) or opaque (black) by a coin-flip procedure. The 
numbers of transparent pixels and opaque pixels are probabilistically same 
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FIGURE 4.4 

An example of random grid (RG). Two random grids (left and middle) and 
reconstructed secret image (right). 


a random grid is 50%: 

°W =1 2- 

value of the random grid R at the position p and 


0 if R(p) is transparent (white) 

1 if R( p) is opaque (black) 

0 if -R(p) = 1 

1 if -R(p) = 0 

We must note that the inverse of a random grid is also a random grid and its 
opacity is 50 %, O(R) = The superimposition of two random grids, R\ and 
R 2 , pixel by pixel is computed by taking Boolean ”OR” operation of their 
corresponding pixels, f?i(p) and i? 2 (p)> as VSSS and EVCS: 

(i?i + i? 2 )(p) = Ri(p) + ^2(p)- 

It is obvious that the superimposition of the same random grids results in the 
original random grid. The superimposition of a random grid and its inverse is 
a grid whose pixels are all opaque. Thus, the average opacity will be as below: 

0(R + R) = O(R) = 0{R + R) = 1. 

The encryption algorithm for a binary image B, which generates a pair of 
random grids R\ and R 2 that can achieve the highest contrast is as follows. 

1 Originally a concept of average transmission was used both in [17] and [37] instead 
of average opacity. However, it is slightly confusing because people usually use 0 for a 
transparent (white) pixel and one for an opaque (black) pixel in visual cryptography studies. 
Thus, here we use the term average opacity. 


and the average opacity 1 of 


Let R( p) denote a pixel 


i?(p) denote its inverse. 


R{ p) = 


R{ p) = 
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Algorithm 

1. Generate a random grid R\ with the same size as B. 

2. For each pixel B(p), a grid R 2 is determined as below: 

m P ) = { ffilL if B(p) = 0 . 

I i?i(p) otherwise 

Let T and O denote transparent and opaque regions of the original binary 
image B so that B( p) = 0| pgT and B( p) = l| pg0 . The regions T and O 
fulfills the following constraints: 

fi = TUO and (f = TnO, 

where f 1 stands for the entire region of the original image while <j> represents 
the null region, because B is a binary image. Due to the definition of the above 
algorithm, random grids R\ and f? 2 satisfies the following relations: 

-Ri(p) = -R 2 (p)| peT and i?i(p) = R 2 (p) | P £=o * 

Therefore, R 2 as well as R\ is a random grid and the average opacity of their 
superimposition depends on the regions T and O of the input binary image: 

C>((l?i + i? 2 )(p))| peT = ^ and 0((i?i + i? 2 )(p))| pe0 = l. 

The difference of the average opacities of region T and O corresponds to 
relative difference a in VSSS. Figure 4.4 shows an example of random grids 
and a reconstructed secret image. The size of all images are 64 x 64 pixels, 
which is the same as that of the original secret images, because Random Grids 
are free from pixel expansion, m = 1. 


4.3 Fundamentals of Photograph Visual Cryptography 

Digital cameras have become very popular and people can easily obtain 
continuous-tone digital image data. However, all the schemes explained in the 
last section accept binary images as input. Thus, a photograph image must 
be converted to a binary image that can be observed similar to the original 
image by the human visual system. The algorithm that can achieve such a 
conversion is referred as digital halftoning or halftoning in short [38, 18]. 

4.3.1 Digital Halftoning 

There are several approaches to digital halftoning, namely, noise-encoding, 
ordered dither, error diffusion, iterative and search-based methods, etc. Here 
we explain some of the approaches. 


© 2012 by Taylor & Francis Group, LLC 


104 


Visual Cryptography and Secret Image Sharing 


6 

7 

8 

9 

5 

0 

1 

10 

4 

3 

2 

11 

15 

14 

13 

12 


0 

8 

2 

10 

12 

4 

14 

6 

3 

11 

1 

9 

15 

7 

13 

5 


FIGURE 4.5 

Samples of ordered dither matrices. Clustered-dot matrix (left) and dispersed- 
dot matrix (right). 


Density Pattern 

It is obvious to achieve (l + 1) gray levels, i.e. , tones, with l binary pixels. 
The density pattern method uses l subpixels for representing each pixel value. 
This is similar to the visual cryptography in the sense that a resulting image 
requires more pixels than the original image. If we adopt this type of halfton- 
ing method, the resulting shadow images and reconstructed secret image are 
Im times larger than the original continuous-tone images. Of course, this is 
inappropriate since people want to make a resulting image as small as possible. 

Noise-Encoding 

The easiest way to obtain a binary image from a continuous-tone image of the 
same size is thresholding, which assigns 0 to a pixel of the resulting binary im- 
age if the original pixel value is smaller than a threshold value. Otherwise it as- 
signs 1 to the binary pixel. However, the resulting binary image usually suffers 
from pseudo-contours. Noise-encoding is a key concept for improving image 
quality. In the early stage of digital halftoning studies, random noise, i.e., white 
noise, is used for this purpose. A binary image obtained by adding random 
noise followed by thresholding yields better quality than a simply-thresholded 
image, because it reduces pseudo-contours. Random dither is a simple exten- 
sion of noise-encoding. It uses a random threshold array and thresholds each 
pixel with a random number instead of using a constant threshold after adding 
a random number to the pixel value. 

Ordered Dither 

Noises need not be random and a threshold matrix can be generated with a 
certain order. Ordered dither generates a binary image by comparing a pixel 
of an original continuous-tone image with a threshold value of the periodic 
ordered matrix. The methods based on ordered dither are classified into two 
categories, clustered-dot ordered dither, and dispersed-dot ordered dither de- 
pending on the nature of generated dots. 

Clustered-dot ordered dither turns adjacent pixels on which form a cluster 
in the matrix. The period length of dots is determined by that of the matrix. 
The tone level of a region is modulated by the area size of clustered-dot. Thus, 
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FIGURE 4.6 

Diagrams of point process and error diffusion. 


this method is categorized as an amplitude modulation (AM) technique. A 
spiral-dot screen, whose sample threshold matrix is shown in Figure 4.5 left, 
is a kind of cluster-dot ordered dither. 

Dispersed-dot ordered dither turns scattered pixels on without making any 
clusters. The result may have a high-frequency fidelity and better appearance 
in constant gray regions. Thus, people prefer dispersed-dot ordered dither to 
clustered-dot ordered dither. The tone level of a region is modulated by the 
density (or frequency) of dots. Thus, this method is categorized as a frequency 
modulation (FM) technique. A famous Bayer’s matrix shown in Figure 4.5 
right is an example of dispersed-dot ordered dither. 

Error Diffusion 

The above-mentioned approaches are said to be point process in a sense that 
each point (or pixel) is processed independently. In other words, an output 
value of a pixel depends only on a value of the input pixel as shown in Figure 
4.6 left. Error diffusion, a commonly-used halftoning algorithm, takes a neigh- 
borhood into account so that it is no more a point process. It is an adaptive 
algorithm that uses the threshold error feedback to produce patterns having 
different spatial frequency content. A single pass is carried out over the in- 
put image each pixel of which is processed sequentially. A single pixel process 
consists of a binary thresholding of the input pixel and an error computation 
caused by the binarization. This error is distributed to the neighboring pixels 
that have not been processed according to an error filter (or error matrix). 
Famous error filters proposed by Floyd and Steinberg [8] and Jarvis et al. [16] 
are shown in Figure 4.7 where X indicates the current pixel. In other words, 
the values of neighboring pixels are corrected to keep the total tone of a local 
region. The schematic diagram of the algorithm is illustrated in Figure 4.6 
right. 

Iterative and Search-Based Methods 

Iterative and search-based methods attempt to obtain the optimum solution 
as a halftoned image by iteration and/or search manner. Since the ultimate 
goal of digital halftoning is to accomplish an illusion of a binary image that is 
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FIGURE 4.7 

Samples of error filters for error diffusion proposed by Floyd and Steinberg [8] 
(left) and Jarvis et al. [16] (right). 



FIGURE 4.8 

A diagram of iterative and search-based method. 


observed completely same as the original continuous-tone image, the method 
tries to minimize the perceived difference between the binary image output 
and the original image. The perceived error is estimated by a spatial filter 
that simulates a human visual system as well as the output device model. 
Direct binary search is one of the popular methods of this kind. The schematic 
diagram of this method is illustrated in Figure 4.8. 

4.3.2 Image Quality and Related Parameters 

Let us discuss quality of resulting images in terms of its parameters in this 
section. 

Tone levels (Z) Due to the nature of the visual cryptography scheme, the in- 
put images, namely, the original images as a secret image and shadow images, 
must be binary. This is a big limitation in the sense of image quality, espe- 
cially for photograph images. Halftoning allows us to convert a continuous- 
tone image to a binary image that can be observed similar to the original 
image by human eyes. However, the halftoned image is not completely the 
same as the original image. It may lose a certain quality of photograph im- 
ages. On the contrary, some types of images, such as images of logos or text, 
are still meaningful even if the tone levels are limited to two or three. 

Pixel expansion (m) Pixel expansion is also an important parameter that 
affects quality of images as well as its data size. The resulting image re- 
quires m times more subpixels, which means that subpixels must be m 
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times smaller than the original pixel if the image size is fixed to that of 
the original image. This results in difficulty of alignment so that transparen- 
cies with smaller subpixels are more difficult to be stacked properly. Mis- 
aligned transparencies cannot reconstruct the secret image. This cannot be 
neglected because one of the most important characteristics of visual cryp- 
tography is the capability that the secret information is revealed by simply 
stacking transparencies without any computation. 

Relative difference (a) It is obvious that contrast is also one of the most 
important parameters related to image quality. An image with low contrast 
is obscure and difficult to see its details. Furthermore, there exists a certain 
tradeoff between contrasts of shadow and secret images in case of extended 
visual cryptography. It is impossible to increase both contrasts of a secret 
image and shadow images simultaneously. 


4.3.3 Photograph Visual Cryptography with Basic Schemes 

The straightforward way to incorporate photograph images into visual cryp- 
tography is as below: 

1. Convert photograph (continuous-tone) images to binary images by 
halftoning. 

2. Encrypt a secret image by one of the schemes explained in Section 
4.2. 

Of course the quality of resulting images may be changed by the halfton- 
ing algorithm. But here we would like to focus on the differences among the 
encryption schemes. 

Table 4.1 summarizes the characteristics of visual cryptography with pho- 
tograph images according to the encryption schemes, i.e. , Visual Secret Shar- 
ing Scheme (VSSS), Extended Visual Cryptography Scheme (EVCS), and 
Random Grids (RG), in the case of (2, 2). Since all three schemes assume that 
shadow images are printed on transparencies and stacked together, the super- 
imposition (stacking operation) can be seen as Boolean ” OR” in mathematical 
sense. The basic properties of VSSS and RG are very similar except for the 
pixel expansions. The pixel expansion of (2, 2) VSSS is m = 2 (it would be 4 if 
one wants to preserve the aspect ratio of a image), while RG’s pixel expansion 
is to = 1. VSSS and RG have no extended capability. They cannot incorporate 
photograph images into shadow images in order to conceal the existence of 
’’secret,” which means the original shadow images are simple monotone images 
(’’mono.”) and encrypted results are random-dot binary images (’’rand.”). In 
other words, the relative difference of shadow images is as = 0. However, 
they can accept a continuous-tone image (”cont.”) as a secret image. A re- 
constructed secret image is a halftoned binary image (’’half.”) whose relative 
difference is an = Only EVCS among the three basic schemes can incorpo- 
rate continuous-tone images into shadow images. The resulting shadow images 
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TABLE 4.1 

Comparison of visual cryptography schemes, namely, VSSS, EVCS, and RG, 
with photograph images in the case of (2,2). Here, m denotes the pixel ex- 
pansion of each scheme, as and as stand for relative differences of shadow 
images and reconstructed secret image, respectively. I ^ and denote the 
tone levels of original images to be processed, while 1$ and Ir denote the 
tone levels of the resulting (encrypted/decrypted) images. Strictly speaking, 
Is and Ir should be 2, because every resulting image consists of white and 
black subpixels. However, for human visual system, an image can be observed 
as a gray-scale image because of halftoning. In this sense, we specify "Is > 2” 
for EVCS and "Ir > 2” for all three schemes, ’’mono.,” ”cont.,” ’’half.,” and 
’’rand.” mean a monotone image, continuous-tone image, halftoned binary 
image, and random-dot binary image, respectively. 


scheme 

m 

shadow image 

AO) , 

a s Is 

secret image 
aR l R Ir 

VSSS 

2 (4) 

0 1 (mono.) 1 (rand.) 

1/2 oo (cont.) >2 (half.) 

EVCS 

4 

1/4 oo (cont.) >2 (half.) 

1/4 oo (cont.) >2 (half.) 

RG 

1 

0 1 (mono.) 1 (rand.) 

1/2 oo (cont.) >2 (half.) 


to be printed on transparencies and reconstructed secret image by stacking 
shadow images are binary images converted by halftoning. The pixel expan- 
sion of (2, 2) EVCS is m = 4. A tradeoff between relative differences of shadow 
image and reconstructed image exists. If we restrict both relative differences 
to be the same, the maximum relative differences are as = aR = |. 
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4.4 Variations of Photograph Visual Cryptography 

Although extended capability is a crucial aspect for visual cryptography with 
a photograph image, contrast of resulting images becomes very low (f at maxi- 
mum) due to the tradeoff between relative differences of the shadow image and 
reconstructed image. Contrast tends to much lower if the number of shadow 
images increases. In order to enhance contrast of encrypted images, several 
researches assumed other kinds of operations for superimposition, namely, 
’’Cover,” [32] ”XOR,” [3, 23] ’’NOT,” etc. [40] Sometimes even a certain com- 
putation is required for decryption [5, 20, 24]. Most of the approaches are no 
longer realized by stacking transparencies. 2 Those schemes may not be cate- 
gorized as visual cryptography, because the most important characteristics of 
visual cryptography is the capability of visual decryption without any compu- 
tation. Therefore, we will not discuss these type of approaches assuming other 
operations than Boolean ”OR.” Instead our discussion will mainly focus on 
(2, 2) schemes. There have been a lot of studies that aim at incorporating color 
into visual cryptography [27, 35, 39, 22, 44, 12, 13, 7, 30, 36, 46, 19]. These 
approaches are strongly related to the techniques for handling continuous-tone 
images. However, this chapter will not discuss those color studies because this 
book contains a special chapter dedicated to color visual cryptography. 

4.4.1 Approaches to Photograph Visual Cryptography 

The main issue for incorporating photographs into visual cryptography is the 
quality of resulting images, i.e. , pixel expansion, relative differences, tone lev- 
els, as we discussed in Section 4.3.2. A lot of approaches to photograph visual 
cryptography intend to improve the image quality by introducing a certain 
limitation and/or by exploiting image processing techniques. Table 4.2 sum- 
marizes those approaches. For instance, [4, 15, 37, 14, 6] limit their shadow 
image to a random-dot binary image (’’rand.”). Actually they do not intend ex- 
tended visual cryptography [33, 34, 21, 41, 9, 47]. Generate very similar images 
(”sim.”) or a positive/negative pair of images (”p/n”) as encrypted shadow 
images. Sometimes only logo-like images with the trace of shadows (’’logo tr.”) 
can be reconstructed as a secret image [33, 34, 21, 41, 9, 10, 45]. [10, 25, 42] uti- 
lize halftoning techniques to make pixel expansion m = 1. [28, 42, 45, 25, 26] 
adjust tone, i.e., dynamic range, of images for improving image quality. Some 
studies introduce continuous-tone subpixels into encrypted shadow images to 
obtain continuous-tone results [45, 29]. The rest of this section explains those 
approaches. 

2 Only "Cover” can be physically realized with transparencies and opaque sheets. Physical 
implementation of ”XOR” is possible by exploiting polarization. 
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TABLE 4.2 

Approaches to photograph visual cryptography of (2,2) scheme, ’’pair” repre- 
sents constraints on a pair of shadow images such as random-dot binary image 
(’’rand.”), similar images (”sim.”), positive/negative pair (”p/n”), and differ- 
ent pair, i.e., no constraint (”diff.”). ’’tone” indicates types of images to be 
reconstructed, ’’logo” stands for a logo-like image, ’’logo tr.” stands for a logo- 
like image with traces of shadows, and ’’gray” stands for a gray-scale image. 
”GAS,” ”RG,” ’’not ext.,” and ”cont. tone” mean General Access Structure, 
Random Grids, not extended, and continuous-tone, respectively. 


approaches 

m 

shadow image 
pair as Is 

secret image 
tone a R l R 

features 

(4, IS] 

>i 

rand. 

0 

1 

gray 

1/2 

< m 

GAS, not ext. 

137] 

i 

rand. 

0 

1 

gray 

1/2 

>2 

RG, not ext. 

1 14, 6J 

i 

rand. 

0 

1 

gray 

1/2 

>2 

( k,n ), not ext. 

M 

>i 

sim. 

~ 1 

m+1 

logo tr. 

> o 

- 

density pattern 

[34, 21, 41J 

i 

sim. 

~ 1 

>2 

logo tr. 

> o 

- 

ordered dither 

r - et 

i 

sim. 

~ 1 

>2 

logo tr. 

> 0 

- 

error diffusion 

[47] 

1&4 

p/n 

<1/2 

>2 

logo 

1/4 

2 

GAS, w/o trace 

F] 

1 

cliff. 

< 1 

>2 

logo tr. 

> 0 

- 

error diffusion 

I45J 

4 

cliff. 

1/4 

OO 

logo tr. 

1/4 

- 

GAS, cont. tone 

[28] 

>1 

cliff. 

>1/4 

<TO 

gray 

>1/4 

<m 

density pattern 

[42] 

1 

cliff. 

>1/4 

>2 

gray 

>1/4 

>2 

iterative search 

[25, 26] 

1 

cliff. 

>1/4 

>2 

gray 

>1/4 

>2 

error diffusion 

PF 1 

2 

cliff. 

>1/4 

OO 

gray 

>1/4 

OO 

cont. tone 
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4.4.2 Random-Dot Shadow Images 

Due to the severe tradeoff between relative differences of the shadow image 
and reconstructed image, some studies focused on the quality of the recon- 
structed image by giving up extended capability. For instance, in 2000, Blundo 
et al. examined a secret sharing scheme with an access structure that can re- 
construct a gray-scale image with g gray levels and specified the upper limit of 
relative differences ai, • • • , a 9 _ i as well as the lower limit of pixel expansion 
m as below [4]: 

minjai,-" ,Q! fl -i}< _ i) 2 fc-i ’ m > {g - l)2 k ~ 1 . 

Iwamoto and Yamamoto precisely discussed an (n, n) secret sharing scheme 
for a gray-scale image in 2002 [15]. 

Another important concern is pixel expansion. Both studies explained 
above accomplish gray levels by controlling the number of white/black subpix- 
els, which means pixel expansion is inevitable. The research for reducing the 
pixel expansion in VSSS is mostly based on a probabilistic approach such as 
Random Grids revisited by Shyu [37]. Since Random Grids have been already 
explained in Section 4.2.3, here we discuss another kind of probabilistic ap- 
proach. Ito et al. proposed a secret sharing scheme with m = 1 by introducing 
randomness into a conventional (k,n) VSSS in 1999 [14]. Their scheme first 
determines a basis matrix according to the value of a secret pixel, black or 
white. Then it randomly selects one of a column of the basis matrix, which 
stands for values of corresponding subpixels in shadow images, and uses them 
as those of shadow pixels. Chen et al. proposed the similar scheme in 2007 [6]. 
They also proposed to use histogram equalization for enhancing contrast. We 
will explain this contrast enhancement technique later in Section 4.4.7. 

4.4.3 Similar Shadow Images 

Another approach is entirely opposite to the studies explained in the previ- 
ous section. It limits the relative difference of secret image to nearly zero and 
attempts to enhance the relative difference of shadow images as much as pos- 
sible. Some research has succeeded in achieving a full relative difference for 
shadow images, namely, as — 1, by using very similar shadow images. The 
key of this approach is the reconstructed secret image. The secret image can 
be observed with the trace of a shadow image. In other words, by overlapping 
very similar shadow images, one can observe obscure dark logos or text within 
the shadow image. 

This type of scheme was first proposed by Oka et al. in 1996 as a water- 
marking technique [33]. One can conceal one’s signature within a halftoned 
image so that one can claim one’s copyright on the image. It uses multiple sub- 
pixels, i.e. , density patterns, to represent a gray pixel of the original shadow 
image. The second shadow image is generated by rearranging dots, i.e., black 
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FIGURE 4.9 

Dither matrices for similar shadow scheme proposed in [34]. 


subpixels, of the first shadow image if the corresponding original secret pixel 
is black. On the contrary, the same arrangement is used if the corresponding 
secret pixel is white. The secret image appears when the shadow images are 
stacked together. It is easy to rearrange subpixels if the gray level of the orig- 
inal pixel is approximately 50% gray. But it is difficult to control resulting 
darkness in the nearly white or black region of the shadow image. Thus, it is 
impossible to guarantee the quality of the reconstructed secret image. 

[34, 21, 41] are modifications of this approach without pixel expansion, 
namely, m = 1, by using ordered dither. For instance, [34] specified sample 
dither matrices based on a Bayer’s matrix as shown in Figure 4.9. Shadow im- 
ages are halftoned by using the same dither matrix if the corresponding secret 
region is white, while they are halftoned with the different dither matrices if 
the corresponding secret region is black. Fu and Au proposed a variation of 
this scheme in 2001 [9]. It uses the error diffusion technique to get halftoned 
results instead of ordered dither. 

4.4.4 Positive and Negative Shadow Images 

The underlying concept of this approach is quite similar to the previous ap- 
proach. It can achieve a large relative difference for shadow images by using a 
positive and negative pair of shadow images instead of a similar pair. It also 
reconstructs a logo or text image as a secret image, i.e. , binary-tone image, 
without any trace of shadow images. 

This scheme was proposed by Zhou et al. in 2006 [47]. It is not limited 
to (2, 2) VSSS and can handle an access structure. However, here we explain 
a basic algorithm to establish a (2,2) secret sharing scheme due to space 
limitations. 

1. The positive shadow image is generated by halftoning the original 
shadow image. The negative shadow image is obtained by reversing 
the positive one. Thus, the overlapping result is entirely black at 
this moment. 

2. A secret pixel is encrypted into a square region of halftoned pix- 
els, Q\ x Q -2 . A pair of black and white pixels, referred to as secret 
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FIGURE 4.10 

The conjugate error diffusion algorithm proposed in [10]. 

information pixels , are selected in each region. The secret informa- 
tion pixels are at the same positions in the shadow images. There- 
fore, corresponding pairs are complementary or a reversal of each 
other. One of the secret information pixels are swapped to obtain a 
brighter result if the corresponding secret pixel is white. 

The shadow image is free from pixel expansion, m = 1, while the pixel expan- 
sion of a secret image is m — QiQ- 2 - It uses the void and cluster algorithm 
to select secret information pixels to keep better image quality. However, it 
requires a black and white pair within a square region to encrypt a secret im- 
age, the relative difference of shadow image is a matter of the size of a square 
region. The shadow images must be grayish if the square region is relatively 
small. 

4.4.5 Error and Secret Diffusion 

This approach considers secret information as extra noise to the shadow image 
and takes into account binarizing error. It can realize a (2, 2) EVCS with 
completely different shadow images. This approach was first proposed by Fu 
and Au in 2003 [10]. The basic algorithm is as below: 

1. The first shadow image is halftoned by the error diffusion algorithm. 

2. The second shadow image is also halftoned by the conjugate error 
diffusion algorithm shown in Figure 4.10. The ’’Noise” is added ac- 
cording to the corresponding pixels of the secret image and the first 
halftoned shadow image. This noise causes a pixel- wise distortion to 
the second shadow image, which is controlled by some appropriate 
threshold T\ . A large Tj allows more pixels to hide the secret image 
but results in a large distortion of the second shadow image. 

This approach is free from pixel expansion, m = 1 . However, [10] originally was 
applied to a logo image as a secret image in order to avoid a huge distortion 
in the second shadow image. It could reconstruct only a faint logo with the 
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traces of both shadow images. One can recognize a logo as well as shadow 
images at the same time. 

Myodo et al. extended this approach to be able to handle a photograph as 
a secret image [25]. It can reconstruct a secret photograph image with very 
little or no trace of shadow images by properly adjusting tones of images. This 
aspect of tone adjustment will be discussed in Section 4.4.7. 

4.4.6 Simultaneous Iterative Search 

This type of method was proposed by Wu et al. in 2004 [42]. It can handle 
three different photographs as two shadow images and a secret image without 
pixel expansion, m = 1. This method consists of two major steps, tone ad- 
justment and simultaneous iterative search. It first adjusts the tones of three 
input images to satisfy a condition on relative differences of shadow and se- 
cret images. Then it simultaneously searches three halftoned images. Since 
[42] contains very little explanation about the two steps, it is hard to know 
the exact algorithm. But it would take a certain amount of time to obtain a 
result if it process is images in a brute-force manner. 

4.4.7 Tone Adjustment 

This type of approach attempts to improve image quality with image process- 
ing technique. It tries to enhance contrasts, namely, dynamic ranges, of the 
resulting images as much as possible. The conventional visual cryptography 
studies consider relative differences, as and an, which represent a limitation 
of possible pixel values. However, the pixel values of shadow and secret images 
are actually limited by lower and upper limits, dynamic ranges, and there is 
a certain interaction among them. 

Nakajima and Yamaguchi precisely examined the interactions of pixel val- 
ues in (2,2) EVCS [28]. There exist constraints among the pixel values of 
three corresponding pixels in shadow and secret images. Let us call the three 
corresponding pixels a triplet. The constraints among values of a triplet are 
represented as below: 

o R £ [max(oi,o 2 ),min(oi +o 2 ,l)] , (4.1) 

where or denotes pixel opacity of reconstructed secret image and oi and o 2 
denote pixel opacities of resulting shadow images. 3 This expression indicates 
that any reconstructed pixel must be equal to or more opaque than the most 
opaque corresponding shadow pixel, max(oi,o 2 ). It also indicates that the 
reconstructed pixel must be equal to or less opaque than the sum of opacities 
of corresponding shadow pixels, oi + o 2 . 

3 In [28], Nakajima and Yamaguchi discussed pixel transparency instead of opacity. How- 
ever, as we already indicated, people usually use 0 for a transparent (white) pixel and 1 for 
an opaque (black) pixel in visual cryptography studies. Thus, here we consider pixel opacity 
rather than pixel transparency. 
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This approach adjusts the tones of given images to make the dynamic 
ranges as large as possible while every triplet fulfills the constraints given by 
Equation (4.1). Affine transformation or piece- wise linear transformation is 
most commonly used for tone adjustment [28, 42, 45, 25, 26]. Wu et al. sug- 
gested to calculate optimum parameters [42]. However, [42] does not explain 
any details how to obtain optimum parameters. Myodo et al. [25] proposed a 
method that can determine optimum parameters at once [26]. They claimed 
that their method can enhance relative differences to 0.28 on average without 
any violation. Their method can control the relative differences independently 
by specifying the weights. 

Another approach uses a contrast enhancement technique called histogram 
equalization or histogram linearization transformation [11], which is very well- 
known for improving the contrast of images. The histogram of an image can be 
seen as a function h{i) that returns a frequency or probability density of pixels 
having an intensity level i, namely a transparency. Histogram equalization 
equalizes or flattens a histogram. This means that frequencies of tone levels 
are totally uniform and the resulting image may have a high contrast. Chen 
et al. [6] as well as Wu et al. [43] suggested a way to improve image quality 
by applying histogram equalization to the input images before encryption. 


4.4.8 Continuous- Tone Subpixel 

Image quality can be improved by increasing tone levels as discussed in Section 
4.3.2. There have been some studies improving image quality by introducing 
continuous-tone subpixels into encrypted shadow images [29, 45]. 

Yang and Chen [45] introduced continuous tone into the resulting shadow 
images. They extended usual EVCS explained in Section 4.3.3 by substitut- 
ing a black subpixel by a gray subpixel having the same gray value as the 
original shadow pixel. This approach can be applied to EVCS with an access 
structure. The drawback of this approach is the trace of shadow images. The 
reconstructed secret image can be observed in superimposed shadow images. 
Thus, a secret image should be a logo or text image. One can recognize a 
logo as well as shadow images at the same time when shadow images are 
overlapped. 

Nakajima and Yamaguchi [29] proposed a very unique approach for im- 
proving image quality by introducing continuous-tone subpixels. Their method 
also deals with a misalignment problem caused by pixel expansion. We will 
discuss this method in the next section. 
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(a) (b) 

FIGURE 4.11 

Examples of subpixel arrangements with enhanced misalignment tolerance. 
If the two subpixels take only binary values as in (a), there is no way to 
control the secret pixel transparency. The reconstructed transparency can be 
controlled by allowing a continuous value for one of the four subpixels as in 
(b). 




4.5 Misalignment-Tolerant Photograph Visual 
Cryptography 

Nakajima and Yamaguchi [29] attempt to improve the image quality while 
maintaining the misalignment tolerance. Their method generates encrypted 
shadow images that are robust to the misalignment error while the resulting 
images may have continuous-tone levels. In this section, we use transparency 
t rather than opacity o in order to simplify the equations. One should note 
that transparency and opacity are simply inverse, t = 1 — o. 

4.5.1 Theory and Implementation 

The basic idea of their method is to use two concentric regions of variable area. 
In other words, it virtually uses two concentric subpixels whose relative sizes 
may change. Here, we treat a pixel as a unit circle instead of a square to make 
the explanation simple. The most enhanced misalignment tolerance between 
the corresponding pixels would be achieved by this concentric arrangement of 
subpixels as shown in Figure 4.11 (a). However, such a subpixel arrangement 
with binary values allow only one degree of freedom even if the area changes, 
i.e., the radius of the inner circle, for each shadow pixel. This is enough for 
realizing the transparency of each shadow pixel but is insufficient to control 
the reconstructed secret pixel transparency. 

To increase the degree of freedom to control the reconstructed trans- 
parency, they extended the halftoning technique by introducing continuous 
(gray-scale) values rather than just binary values to the concentric subpixels. 
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(a) (b) (c) 

FIGURE 4.12 

Variation of subpixel arrangement having the same transparency. To maintain 
an average transparency shown in (a), the inner circle must be more opaque 
than the original transparency if the outer ring is completely transparent as 
in (b). Similarly, if the outer ring is completely opaque, the inner circle must 
become more transparent than the original transparency as in (c). 


There are four subpixels in the corresponding shadow pixels: one inner circle 
and one outer ring for both pixels. A gray-scale value is assigned to one of 
the four subpixels, and binary values to other three subpixels. Figure 4.11 (b) 
show’s an example of assigning a gray value to the outer ring of shadow 2. 
A variety of reconstructed transparencies are obtained by changing the gray 
value and the radius of the inner white circle simultaneously. 

Let ij.Oj £ [0, 1] be the transparencies of the inner circle and the outer 
ring, respectively, of shadow j £ {1. 2}, and r_, £ [0, 1) be the radii of the inner 
circles, respectively. The transparency of shadow’ j is written as 

tj = (1 - + r ] 2 ij- 

If we suppose ri > r 2 , the reconstructed transparency f jj becomes 
tR = (1 - r 1 2 )o 1 o 2 + (rj 2 - r 2 2 )qo 2 + r 2 2 qi 2 , 


because the superimposed transparency is calculated by taking the product 
of transparencies. 

The encryption corresponds to calculating ix,*2i°l)° 2 , r li’’ 2 for given 
Here, only one of i\ , i 2 , eq and o 2 takes a value within the inter- 
val [0, 1], while the remaining three are either 0 or 1. If all four subpixels take 
binary values, i.e., ij, i 2 , 01,02 € {0, 1}, there are four possible cases shown as 
below: 


(a) 

h = 0, 

01 = 1, 

h = 0, 

o 2 = 1, 

(b) 

*1 = 0 , 

01 = 1, 

*2 = 1, 

02 = 0 , 

(c) 

*1 = 1, 

01 = 0, 

i 2 = 0, 

02 = 1, 

(d) 

*i = 1, 

01 = 0, 

h = 1, 

02 = 0 . 


Now consider the other cases where either one of i\ , i 2 , 01 , 02 takes a contin- 
uous value. For example, suppose the inner circle of shadow 1 is gray, namely, 
ii £ (0, 1). When the outer ring is completely transparent as shown in Figure 
4.12 (b), the gray level of the inner circle, q, must be more opaque than the 


© 2012 by Taylor & Francis Group, LLC 


118 


Visual Cryptography and Secret Image Sharing 


shadow 1 



shadow 2 
(initial) 

o 


shadow 1 shadow 2 
(maximized) 



FIGURE 4.13 

An example of pattern change for maximizing the difference of inner circles’ 
radii, rj — r^. 


initial maximized 

<$• 

initial maximized 

00-00 

initial maximized 

•o *o 

<®csMi>® 

oo 

mo 

mo mo 

•(•Mi® 

oo 

mo 

<§>® 

00-00 

o« 

o® 


o®-o® 

o®-o® 



FIGURE 4.14 

All the possible pattern combinations of subpixel arrangements and the results 
of maximizing the difference, r\ — r^. 


original transparency t\ to preserve the average transparency of shadow 1. 
Otherwise, the average pixel transparency exceeds tj. Similarly, i\ must be- 
come more transparent than t\ if the outer ring is completely opaque as shown 
in Figure 4.12 (c). Therefore, when i\ €E (0, 1), there are four possibilities as 
below: 


(i) 

0 < «x < t\, oi = 1, 

*2 = 0, 

02 = 1, 

(ii) 

0 < *i < ti, oi = 1, 

h = 1, 

02 = 0, 

(iii) 

h < *i < 1, 0i = 0, 

ii = 0, 

02 = 1, 

(iv) 

*!<*!< 1, Ol = 0, 

*2 = 1, 

02 = 0. 

There are 16(= 

4x4) possibilities, if either one 

of ii,i 2 )Oi, and oq ex- 


clusively can take a value of (0, 1). One may hypothesize that the difference 
of the radii of two inner circles determines the misalignment tolerance. The 
misalignment tolerance is enhanced by maximizing the difference of the radii, 
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FIGURE 4.15 

Physical implementation of the concentric subpixel arrangements using square 
patterns. 


ri — r 2 . For example, Figure 4.13 illustrates a case where the inner circle of 
shadow 2 becomes smaller for maximizing the difference by being completely 
transparent. Half of the sixteen cases amount to the first four binary cases by 
this difference maximization as illustrated in Figure 4.14. Thus, the number 
of possible cases after the maximization is 12 (= 4 4- 16 — 8). 

The case whose difference, r\ — r 2 , is the largest among the 12 cases should 
be adopted in order to maximize the misalignment tolerance. However, using 
such cases results in patches of the same patterns in the shadow images. In 
such situations, the patch boundaries are noticeable. Pattern changes may be 
caused by the other two pixels of the pixel’s corresponding triplet. Thus, the 
boundary may imply the information of the secret image as well as the other 
shadow image. To avoid this unpleasant visual effect, a case should be chosen 
in a weighted random manner using the difference, ri — r 2 , as the weight. 

In the actual procedure, a pixel is implemented by tiny subpixels aligned 
in a square. The inner circle is approximated by subpixels aligned in a square 
tilted by 45 degrees as shown in Figure 4.15. This is because the human eye’s 
sensitivity to artifacts produced by a periodic pattern is the least when the 
periodicity axis makes an angle of about 45° or —45° with the horizontal 
direction. The number of subpixels forming the inner square is determined by 
the area of the inner circle, rj. 

The entire process of encryption is as below: 

1. Take three input gray-scale images and adjust their tones to allevi- 
ate the constraint condition on triplet value (4.1). 

2. Generate two encrypted shadow images by processing each pixel 
triplet: 

(a) choose one of the cases shown in Figure 4.15 in a weighted 
random manner and 

(b) generate the actual subpixel arrangements according to the 
fixed parameters, ij,oj, and rj (j 6 {1,2}). 
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FIGURE 4.16 

Input images. From left to right, original shadow 1, shadow 2, and secret 
images, respectively. 


4.5.2 Results 

Figure 4.16 shows the three input images. Each image corresponds to the 
shadow 1, shadow 2, and secret image, respectively, from left to right. Figure 
4.17 gives the encrypted shadow 2 (above) and the secret image reconstructed 
by superimposing the output shadows (below). They are generated with 15 x 15 
physical subpixels per pixel. For comparison, the shadow 2 (above) and re- 
constructed secret images (below) generated with the straightforward density 
pattern are depicted in Figure 4.18. The images in Figure 4.18 contain 3x3 
subpixels per pixel, a practical number of subpixels considering the superim- 
position by human hands. 

The method is possible to generate quite pleasant results of high image 
quality, especially with smoother shading of the petals and the background 
stems, or the whiskers and stripes of the cat. This is because the method can 
express at least 226 = (15 x 15 + 1) gray levels, which means that the resulting 
images can almost fully express the gray levels of the input images. Moreover, 
the encrypted shadow images can be superimposed by human hands with little 
difficulty, as they allow more misalignment tolerance. 


4.6 Conclusions 

This chapter explained extended visual cryptography handling photograph 
images. First, we overlooked the three basic visual cryptography schemes for 
binary images, namely, the Visual Secret Sharing Scheme, the Extended Vi- 
sual Cryptography Scheme, and Random Grids. Some fundamental concepts 
for incorporating photographs into visual cryptography, such as halftoning 
techniques, some parameters related to image quality, and issues for handling 
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FIGURE 4.17 

Examples of resulting images. The upper image is the encrypted shadow 2 
and the lower image is the secret image reconstructed by superimposing two 
shadows by computer simulation. 
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FIGURE 4.18 

Examples of the output with density pattern using 3x3. The upper image is 
the encrypted shadow 2 and the lower image is the secret image reconstructed 
by superimposing the two shadows by computer simulation. 
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photographs are observed. Then we surveyed approaches for handling photo- 
graph images, most of which are aimed at improving image quality. Finally, 
we have discussed one the most unique approaches proposed by Nakajima and 
Yamaguchi [29]. Although the method does not guarantee perfect security, it 
can generate very pleasant results of high image quality while maintaining 
misalignment tolerance. 
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5.1 Introduction 

Visual cryptography schemes allow the encoding of a secret image, consisting 
of black or white pixels, into n shares that are distributed to the set V of n 
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participants. The shares are such that only qualified subsets of participants 
can ’’visually” recover the secret image. The secret pixels are shared with 
techniques based on subdividing each secret pixel into a certain number m, 
m > 2 of subpixels. Such a parameter m is called the pixel expansion, since 
the reconstructed shared image becomes m times bigger than the original. 
This cryptographic paradigm was introduced by Naor and Shamir [16]. They 
analyzed the case of ( k , n)-thresholcl visual cryptography schemes, in which a 
black and white secret image is visible if and only if any k transparencies are 
stacked together. 

The pixel expansion has a number of drawbacks, affecting the quality of 
the reconstructed image and the complexity of the visual cryptography scheme 
(VCS). In some cases, the pixel expansion is exponential, and this limits the 
applicability of the VCS. In general, the ’’quality” of the reconstructed image 
depends both on the pixel expansion and on the contrast, which is another 
measure of the goodness of the scheme. A number of papers studying the 
best pixel expansion and the best contrast have appeared in the literature. A 
partial list of such papers include [2, 4, 5, 6, 7, 12, 14, 15]. Some other papers 
have focused on different models or properties. For example, in [1], visual 
cryptography schemes for general access structures (where the qualified set 
of participants are arbitrary and not defined by a threshold of participants) 
have been studied. Schemes where the shares show meaningful pictures (not 
related to the secret) are studied in [3]. In [24] the problem of not distorting 
the original image is considered. Some research has also considered the case 
of colored images (see for example [10, 9, 19, 25]). 

To deal with the pixel expansion, Yang [22, 23] has introduced a new 
model of visual cryptography in which the reconstruction of the secret image 
is probabilistic, but the shares have the same size of the secret image, i.e., the 
schemes have no pixel expansion. To be fair, a first attempt to provide VCS 
without pixel expansion has been done by Ito et al. in [13]. In both Ito and 
Yang models, each pixel is reconstructed ”OR”ing the corresponding single 
pixel contained in the shares. Such models are called probabilistic, because 
they give no absolute guarantee on the correct reconstruction of the original 
pixel: in some cases, the reconstructed pixel is wrong. This differs from the 
traditional VCS, which are now called deterministic, where the reconstruction 
of an ’’approximation” of the secret pixel is guaranteed. Here the approxi- 
mation means that a white (black) pixel can be, in some cases, replaced in 
the reconstructed image by a set of subpixels having a given set of white- 
ness (blackness). Since in probabilistic models the secret pixel is correctly 
reconstructed with some probability, the quality of the reconstructed images 
depends on how big is the probability of correctly reconstructing the secret 
pixels. 

Between deterministic schemes and probabilistic schemes it is possible to 
set a trade-off. In a deterministic scheme a certain pixel expansion is paid 
for the guarantee of a correct reconstruction. In a probabilistic scheme a re- 
construction with no pixel expansion is paid with a (small) probability of 
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making mistakes in reconstructing the secret image. In some cases it is pos- 
sible to sacrifice some pixel expansion in order to improve the probabilistic 
reconstruction of the secret image or vice versa. Yang’s model has been gener- 
alized in Cimato et al. [11] showing how it is possible to trade pixel expansion 
for the probability of a good reconstruction. Such a model can be seen as a 
generalization of both the classical deterministic model and the probabilistic 
model introduced by Yang [22]. Moreover, there exists a one-to-one mapping 
between probabilistic schemes with no expansion and deterministic schemes; 
such a mapping trades the contrast of the deterministic scheme with the prob- 
ability factor of the probabilistic scheme. Other proposals in literature have 
been introduced to deal with non-OR-based vcs and to extend the approach 
to color and grayscale images. 


5.2 Visual Cryptography Schemes 

A formal definition of the probabilistic model has been given in [11], gen- 
eralizing Yang’s approach and extending the traditional definition of VCS. 
In the next subsection we review the notions related to traditional VCS, be- 
fore introducing the definition of probabilistic visual cryptography schemes in 
subsection 5.2.2 

5.2.1 The Deterministic Model 

The secret image consists of black and white, where usually white color is 
interpreted as transparent, so that the superposition of white pixels, let the 
color of the pixel contained in the other shares pass. In order to share each 
pixel of the secret image the owner of the secret, usually called the dealer, 
provides each participant with a share, which is an enlarged version of the 
secret pixel consisting of a certain number m of subpixels. So the shared 
version of the original secret pixel will consists of m pixels, which are called 
subpixels because all together they represent the original secret pixel. 

The shares can be conveniently represented with n x m matrices where 
each row represents one share, i.e., m subpixels, and each element is either 
0, for a white subpixel, or 1 for a black subpixel. A matrix representing the 
shares is called the distribution matrix. Physically, the shares are given out in 
the form of printed transparencies. Given a distribution matrix M and a set 
Q of participants, the notation M® refers to the submatrix of M consisting 
of only the rows corresponding to participants in Q. 

To reconstruct the secret image a group of participants stacks together the 
shares. Since each secret pixel is represented by m pixels in the shares, the 
reconstructed image will be bigger than the original (depending on rn and on 
the actual positions of the pixels, the image can also be distorted; a perfect 
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square is a good choice for m because it avoids distortion). Depending on the 
stacked shares, each secret pixel will be reconstructed with a certain number 
of black and white subpixels. A reconstructed pixel is considered white if the 
number of white pixels in its reconstruction is big enough, i.e., the number of 
black subpixel is less than or equal to a given threshold £, and is considered 
black if the number of black subpixels is big enough, i.e., greater or equal 
a given threshold h. Obviously one has to require that £ < h. 1 £ and h are 
called the contrast thresholds of the scheme. In some other papers, the contrast 
thresholds are used slightly differently: m—h is an upper bound on the number 
of black subpixels in a white pixel and m — £ is a lower bound on the number 
of black subpixels in a black pixel. 

Since a reconstructed pixel has to be either black or white, we consider 
only schemes such that in the reconstructed image each reconstructed pixel 
has a number of black pixels, which is either < t or > h. An easy way to 
resolve ambiguities in the reconstruction is to assume i = h — 1 . 

We consider threshold schemes where a qualified set of participants consists 
of k or more participants. For these schemes, a nonqualified set of participants, 
i.e., a set of less than k participants, will not have any information about the 
secret image from the shares. Instead, a qualified set of participants, i.e., a 
set of at least k participants will be able to reconstruct the secret image. The 
quality of the reconstructed image depends on the scheme. 

In a deterministic scheme the quality of the reconstructed image depends 
on the so-called contrast that is a function of the pixel expansion m, and 
the contrast thresholds l and h. The contrast of a scheme is defined as 7 = 
(h — £)/m. 

In a deterministic scheme it is guaranteed that, for any qualified set of 
participants, the pixel is reconstructed correctly; that is, if the secret pixel is 
white then the number of black subpixels in the reconstructed image, corre- 
sponding to that secret pixel, is at most £, whereas if the secret pixel is black, 
the number of black subpixels in the reconstructed pixel is at least h. 

In order to provide shares to the participants the dealer chooses uniformly 
at random a distribution matrix from a collection of matrices Cb , if the secret 
pixel is black, or from a collection of matrices C\y, if the secret pixel is white. 
Hence, for a deterministic scheme it holds that for any distribution matrix M 
of the set Cb, the reconstruction of a pixel obtained by M® for any qualified 
set Q, gives at least h black subpixels, whereas for any distribution matrix M 
of the set Cyy the reconstruction of a pixel obtained by M ( £ for any qualified 
set Q , gives at most l black subpixels. Let us report here the formal definition 
of a deterministic VCS: 

Definition 1 Let (rQ ua |,rF or b) be cm access structure on a set of n partici- 
pants. Two collections (multisets) of n x in boolean matrices Cyy cmd Cb con- 
stitute a visual cryptography scheme (rQ ua |, Tporb, m)- VCS if there exist the 
integers £ and h, £ < h, such that: 

1. Any (qualified) set Q = {ii,i 2 , • • • , i p } £ rQ ua [ can recover the 
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shared image by stacking their transparencies. 

Formally, for any M £ Cyy , the ”or” V of rows i i, * 2 , . . . , i p satisfies 
w(V) < t; whereas, for any M £ Cb it results that w(V) > h. 

2. Any (forbidden) set X = {?'i, * 2 , • • • , ip} € Tporb has no informa- 
tion on the shared image. 

Formally, the two collections ofpxm matrices V t , with t £ { B , W}, 
obtained by restricting each nxm matrix in Cx to rows i\, ii, ■ ■ ■ , i P 
are indistinguishable in the sense that they contain the same matri- 
ces with the same frequencies. 

In many schemes, the collection Cw (resp. Cb) consists of all the matrices 
that can be obtained by permuting all the columns of a matrix Mw (resp. 
Mb). For such schemes, the matrices Mw and Mb are called the base matri- 
ces of the scheme. Base matrices constitute an efficient representation of the 
scheme. Indeed, the dealer has to store only the base matrices and in order to 
randomly choose a matrix from Cx he has to randomly choose a permutation 
of the columns of the base matrix Mx- 

A scheme is characterized by several parameters: the number of partic- 
ipants n, the threshold k that determines whether a set of participants is 
qualified to reconstruct the image, the pixel expansion m, and the contrast 
thresholds £ and h, which determine whether a reconstructed pixel is consid- 
ered white or black. 

5.2.2 The Probabilistic Model 

In a probabilistic scheme the reconstruction property is no more guaranteed, 
but each pixel can be correctly reconstructed only with a probability given as 
a parameter of the schema. This means that the distribution matrices must be 
carefully selected in order to satisfy the above properties. For a probabilistic 
scheme, as done in [22], it is possible to define the probabilities of (un)correctly 
reconstructing a (black)white pixel, given a qualified set of participants Q. 
With Pi\j is denoted the probability of having a reconstructed pixel i, given 
that the corresponding pixel in the secret image was j, where i,j £ {b,w}. 
Then p w \ w (Q), denotes the probability of correctly reconstructing a white 
pixel when superimposing the shares of Q , and Pb\ w (Q) as the probability of 
incorrectly reconstructing a white pixel. Notice that p w \ w (Q) = \(FF\ w h ere z 
is the number of distribution matrices M in Cw for which M® reconstructs 
a pixel with at most i black subpixels and Pb\ w (Q) = j^Aq where z is the 
number of distribution matrices M in Cw for which M Q reconstructs a pixel 
with at least h black subpixels. In a similar way Pb\b(Q) and p w \b{Q) can be 
defined. 

The quantities 

Pb\b{Q) Pb\w(Q) 
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and 

Pw\w(Q ) Pw\b{Q) 

return then a measure of the goodness of the scheme for the given qualified set 
Q. The bigger the above differences the better is the scheme. If both quantities 
are equal to 1 for all qualified sets, then the scheme is again a deterministic 
one, with no possible error in the reconstruction. 

If there exists a positive constant (3 such that for any qualified set Q it 
holds 

Pb\b{Q ) Pb\w(.Q) — ft 

and 

Pw\wi.Q ) Pw\b{Q) — ft- 

then the scheme is called /3-probabilistic, meaning that /3 denotes the possible 
error in the reconstruction. Notice that when every reconstructed pixel is 
either white or black, that is, the reconstructed pixel has at most l black 
subpixels or at least h black subpixels, we have that for any Q , 

Pw\w(Q') = 1 Pb\w(Q) 


and that 

Pb\b{Q ) 1 Pw\b{Q) 

and thus, 

Pw\w(.Q ) Pw\b{Q ) PblbiQ') Pb\w{Qft 

The value £ and h are the thresholds that define the number of subpix- 
els needed to correctly distinguish between a white and black pixel in the 
reconstructed image. For some scheme, for some qualified set Q , it could be 
possible to obtain a secret pixel with a number of black subpixels strictly 
greater than £ and strictly less than h, where the reconstructed pixel is 
neither white nor black. In this case the value Pb\b(Q) ~ Pb\w(Q) might be 
different from p w \ w (Q) — p w \b(Q)- To avoid such kind of ambiguous situ- 
ations, it is possible to fix the value £ = ft — 1, so that the equation 
Pw\w(Q) - Pw\b(Q ) =Pb\b(Q) ~Pb\w(Q) always holds. 

Probabilistic schemes are then characterized by a further parameter: the 
probabilistic factor (3. In the following a probabilistic scheme will be described 
by all these parameters (that is, (3, k, n, £, ft, and to) which are referred to as 
the characteristic parameters of the scheme. 

It is now possible to provide the formal definition of a /3-probabilistic 
threshold visual cryptography scheme with characteristic parameters 
( k,n,£,h,m ), for short /3-probabilistic (k,n,£,h,m)-V CS. The definition nat- 
urally extends also to general access structures. 

Definition 2 A (3-probabilistic ( k,n,£,h.,m)-VCS consists of two collections 
of n x to binary matrices, Cw nnd Cb, satisfying the following properties: 
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1. There exists (3 > 0, such that for any set Q of exact k partici- 
pants p b \b{Q) - Pb\w(Q) > (3 and p w \ w (Q ) - p w \b(Q) > (3 

2. For any set Q of strictly less than k participants, the sets = 
{MQ\M g C w j and cf = {M®\M G Cb} are equal. 

Notice that the definition of the scheme requires the reconstruction of 
a secret pixel (Property 1) to be well defined for qualified sets of exact k 
participants. This is without loss of generality because if a qualified set has 
more than k participants one can simply choose k of the shares and use only 
those k shares to reconstruct the image. Hence in the rest of the chapter a 
qualified set is assumed to consist of exact k participants. 

The goodness of a scheme is measured by the pixel expansion m, the 
contrast 7 = (h — £)/m and by the probabilistic factor (3. Notice that for 
to = 1 the above definition is equivalent to the one provided by Yang [22]. 
Whereas for a big enough to, it is possible to construct schemes with (3=1, 
and in such a case the above definition is equivalent to the classical definition 
of a visual cryptography scheme. 

If the pixel expansion to is assumed to be a parameter of a scheme, then 
on one extreme, when m = 1 one gets the probabilistic model with no pixel 
expansion, and on the other extreme, when to is big enough, one obtains the 
deterministic model. In between such two extremes it is possible to consider 
probabilistic models with a given pixel expansion, trading the probability of 
a good reconstruction with the number of subpixels required to reconstruct 
each secret pixel. 


5.3 Canonical Probabilistic Schemes 

By restricting the attention on a particular class of probabilistic schemes, it is 
possible to show that results valid for all the other schemes can be obtained, 
without loss of generality. The trick is to prove that for a given scheme it is pos- 
sible to define a similar scheme satisfying well-defined additional properties, 
without modification on the parameters of the scheme. For this reason canon- 
ical /3-probabilistic ( k , n, £, h, to)-VCS schemes are defined as those schemes 
that satisfy the following properties: 

1. The cardinality of the collections Cw and Cb are equal and 

2. For any two qualified sets Q\ and Q2 of participants, we have that 
Px\y{Qi) = Px\y{Q2), for x G {w, b} and y G {w, b}. 

The first lemma says that given a probabilistic scheme S a new scheme S' 
can be constructed such that the cardinality of Cw{S') is the same as that of 
Cb{S') and such that S' has the same characteristic parameters as S. 
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The following lemma is similar to the analogous result proved in Section 
2.1 of [1] for deterministic schemes. 

Lemma 1 Given a (3 -probabilistic (k,n,£,h,m)-VCS S, there exists a (3- 
probabilistic ( k,n,£,h,m)-VCS S' such that \Cw(S')\ = |Cb(>S ,, )I- 

Proof Fix a (3 -probabilistic ( k,n,£,h,m)-VCS S, let rq = |Cw(<S')| and r 2 = 
|Cb(<S')| and assume that rq ^ r-i (otherwise we can choose S' = S and we 
are done). Let r = rq • r 2 and construct S' by letting Cw(S') (resp. Cb(S')) 
consists of all the matrices ofCw(S) (resp. Cb(S)) each one repeated r 2 (resp. 
r \) times. It is obvious that \Cw(S')\ = |Cb(S")| = r. 

Since we have only repeated matrices of the collections C it is easy to see 
that k,n, and m remain the same. Keeping the same I and h also (3 stays the 
same: indeed Cw(S') is obtained by replicating the same number of times each 
matrix ofCw(S) and thus the probabilities p w \ w (Q) and Pb\ w (Q) do not change 
for any Q and similarly for p w \b(Q) and Pb\b(Q) since Cb(S') is obtained by 
replicating the same number of times each matrix ofCs(S). 

The following lemma shows that schemes can be built where the number 
of black subpixels in a reconstructed pixel does not depend on the particular 
qualified set of participants chosen to reconstruct the secret pixel and the 
characteristic parameters remain the same. 

Lemma 2 Given a (3 -probabilistic ( k,n,£,h,m)-VCS S, there exists a (3- 
probabilistic ( k,n,£,h,m)-VCS S' such that for any two qualified sets Q\ and 
Q 2 of participants, we have that p x \ y (Q i) = p x \y(Q 2 ), for x € {re, 6} and 
y e {w,b}. 

Proof Fix a f3 -probabilistic (k,n,£,h,m)-VCS S. Consider first Cw(S) and 
assume that the desired property does not hold. Then we build a new scheme 
S' where Cw(S') is obtained from C\y(S) in the following way: for each matrix 
M ofCw(S) insert into Cw(S') all the matrices that we can build from M by 
permuting in all possible n! ways its rows. The collection Cb(S') is obtained 
in the same way from Cb(S). 

Let Q i and Q 2 be two qualified sets. We have that C^f(S') = C^f(S'); 
indeed, by construction both sets contain, for any qualified set Q, all the ma- 
trices in C^.{S), with the same midtiplicity (the multiplicity is due to the fact 
that when restricting the attention to the rows in Q, the other n — k rows 
can be taken in any order). Hence, we have that p w \ w (Qi) = p w \ w (Q 2 )> and 
Pb\w{Qi) = Pb\w{Q 2 )- For the same reason we have C® 1 (S') = C% 2 (S') and 
thus p b \b(Qi) = Pb\b(Q- 2 ), and p w \ b (Q 1 ) = p w \b(Q 2 )- 

By Lemmas 1 and 2, it follows that considering only canonical schemes is 
without loss of generality, because for any scheme S an equivalent canonical 
scheme S' having the same characteristic parameters of scheme S can be 
provided. 


© 2012 by Taylor & Francis Group, LLC 



Probabilistic Visual Cryptography Schemes 


135 


In the following only canonical schemes will be considered, remembering 
that for a canonical scheme p x \ y (Q 1 ) = p x \y(Q 2 ), for x € {ru, b} and y £ { w , 6} 
and thus we will just write p x \ y , without specifying the qualified set. 


5.4 Probabilistic Schemes with No Pixel Expansion 

Probabilistic threshold schemes give the possibility to construct a VCS scheme 
with no pixel expansion, that is having m = 1. In [22] it has been proved 
that a deterministic scheme S with contrast j(S) can be transformed into 
a /^-probabilistic scheme S' with f3(S') = 7 (S) and no pixel expansion. In 
[11] a complementary result has been proven showing that there is a one-to- 
one correspondence between the probabilistic model with no pixel expansion 
and the deterministic one where the contrast is traded for the probabilistic 
factor. Indeed a /3-probabilistic scheme S with no pixel expansion can be 
transformed into a deterministic scheme S' with contrast 7(5' / ) = /3{S). An 
immediate consequence is that any bound on the contrast of a deterministic 
scheme is also a bound on the probabilistic factor of probabilistic schemes 
with no pixel expansion. In the following we report the lemma proving the 
correspondence between probabilistic schemes with no pixel expansion and 
deterministic schemes. 

The following lemma has been proved in [22] and applies to VCS with 
basis matrices. 


Lemma 3 [22] Let S be a deterministic (k, n, £, h, m)-VCS with base matrices 
Mb and Mw ■ Then , there exists a canonical (3 -probabilistic ( k , n, £', h' , 1 )-VCS 
scheme with j3 = 7 (S). 


Proof Let S be a deterministic ( k,n,£,h,m)-VCS . Construct a probabilistic 
scheme S' , by letting Cb(S') (resp. Cw(S')) consists of all the n x 1 vectors 
that appear in the matrices Mb (resp. Mw). 

We need to prove that S' is a (3 -probabilistic (k,n,£' ,h' ,m')-VCS scheme 
with £! = £ , h! = h , m! = 1 and (3 = 7 (S) = (h — £)/m. Obviously S' has pixel 
expansion m! = 1 . 

By the properties of S, we know that when the secret pixel is black the 
reconstruction in S gives at least h black subpixels, that is p^ > h/m. Obvi- 
ously this gives p w i;, < (m — h)/m. Similarly, we have p w \ w > (m — £)/m and 
Pb\w < t/m- 

Hence, in S' we have that 


and 


Pw\w Pw\b ^ 


m — £ 
m 


m — h h — £ 
m to 


Pb\b Pb\w 



m 


m 


h-t 
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and thus we can set j3 = The security property is immediate. 

Example 1 Consider as starting point the deterministic scheme (3,4) having 
basis matrices Mjy and Mb reported below, whose parameters are m — 6 , 
h = 5, l = 4, a = 1/6: 
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To illustrate the construction, consider the following probabilistic 
(3, 4, 4, 5,1 )-VCSS. 
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0 


1 


0 

1 

1 


1 


0 


0 
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Let S be the (n, n, 0, 0, 1)-LC5 obtained applying Lemma 3 to scheme Sd- 
For scheme S we have thatpb\b = 5/6, p w \b = 1/6, p w \ w = 1/3, Pb\ w = 2/3,/? = 

7(5') = 1/6. 


Lemma 3 shows how starting from a deterministic scheme with base ma- 
trices it is possible to obtain a corresponding probabilistic scheme. A more 
general version of the above lemma we report below has been given in [11] 
showing the transformation from a general (also with no base matrices) de- 
terministic scheme to a probabilistic one. 


Lemma 4 Let S be a deterministic ( k,n,£,h,m)-VCS . Then, there exists a 
canonical (3 -probabilistic ( k , n, 0, 1, 1 )-VCS scheme with (3 = 7(5). 

Proof Let S be a deterministic ( k,n,£,h,m)-VCS . Construct a probabilistic 
scheme S' , by letting Cb(S') (resp. Cw(S')) consists of all the n x 1 vectors 
that appear in all the matrices of Cb(S) (resp. Cw(S)). 

We need to prove that S' is a (3 -probabilistic (k,n,F ,h! ,m')-VCS scheme 
with (I = 0, h! = 1, m! = 1 and (3 = 7 (5) = (h — I)/m. Obviously S' has pixel 
expansion m! = 1. We set £' = 0 and h' = 1 and we have to prove that this 
results in a (3 -probabilistic scheme. 

Let r = |Cb(5)|. By the properties of S, we know that when the secret 
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pixel is black the reconstruction in S gives at least h black subpixels, that each 
matrix of Cb(S) has at least h columns, which reconstruct black. Hence, in S' 
we have at least r-h columns that reconstruct black. Since |Cb(S")| = r-m we 
have that pb\b > h/m. Obviously this gives p w \b < (to — h)/m. Similarly, we 
have p w \ w > (to — t)/m and Pb\ w < i/m. 

Hence, in S' we have that p w \ w — p w \b > and pb\b — Pb\w > and 
thus we can set (3 = . The security property is immediate. 

For a canonical scheme it is possible to define the characteristic vectors as: 

C B = ( C *B > c b) 

and 

cw = ( c W i c w> ■ ■ ■ > c w ) 

where c l x is the number of matrices of Cx that provide a reconstruction, 
by any qualified set, of the secret pixel with exactly i black subpixels. The 
characteristic vectors are well defined because, by Property 2 of canonical 
schemes, each c l x does not depend on the particular qualified set chosen for 
reconstructing the secret pixel. 

The following lemma complements the results presented above, showing 
how it is possible to transform a probabilistic (canonical) scheme into a de- 
terministic scheme. 

Lemma 5 Let S be a (3 -probabilistic canonical (. k , n , 0, 1, 1 )-VCS and let cb = 
(c%,c B ) and cw — ( c w’ c w) be its characteristic vectors. Then, there exists 
a deterministic (k,n,i' ,h! ,m')-VCS S' with i! = c(y, h' = c B , m! = |Cv^(S)| 
and contrast 7 (S') > (3(S) . 

Proof Let S be a (3 -probabilistic (k, n, 0, 1, 1)-VCS satisfying the hypothesis 
of the lemma. Scheme S' is constructed by letting its base matrix Mb (resp. 
Mw) consist of all the vectors of Cb{S) (resp. Cw(S)). Fix T = c(y and 
h' = Cg. We have to prove that S' is a deterministic {k,n,(! ,h! ,m')-VCS 
with m! = r, where r = |Cw(S')| = |Cb(S)|. 

Both Cb(S) and Cw(S) contain r matrices of dimension n x 1; hence, the 
dimension of both Mb and M\y is n x r; thus, m! = r. 

Since S is a (3 -probabilistic scheme, we have that. Pb\b~ Pb\w > (3 > 0 hence, 
Pb\b > Pb\w> an d since Pb\b = c x B /r and Pb\ w = cf^/r, we have c B > c ( v . Thus, 
£' < h' . Now we need prove that the scheme is deterministic. Scheme S' is a 
basis matrices scheme, so all the matrices of the collections Cw(S') andCsiS') 
are equal up to a permutation of the columns; moreover it is easy to see that a 
reconstructed black pixel always has h! black subpixels and that a reconstructed 
white pixel always has T black subpixels. Hence, we have p' b ^ b = p' w \ w = 1 and 
p'w\ b = p'b\ w = 0- Hence, scheme S' is deterministic. 

Let us consider the security property. Fix a nonqualified set of participants 
and consider the corresponding k' < k rows of the basis matrices. Each of these 
rows can be seen as the concatenation of shares of S (one per each matrix in 
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the collections Cb(S) and Cw(S)). By the security property of S we have that 
the k! rows of Mb are equal to the k ' rows of Mw, except for a permutation 
of the columns. Hence, S' satisfies the security property. 

Finally, the contrast of S' is 7 (S') = = Cb ~ Cw = Pb\b~Pb\w > P(S). 

As already said, the correspondence between deterministic schemes and 
probabilistic schemes with no pixel expansion allows the reuse of bounds 
found on the contrast as bounds on the corresponding probabilistic factor. 
For example, in [14] it has been proved that the contrast of any deterministic 
(2, n)-V CS is upper bounded by 


7 < 7 


4_( fe _i) 

n(n 


!)■■■(« 


(*-!))’ 


(5.1) 


As an immediate, the following lemma, which is a corollary of Lemma 5, 
also holds: 


Corollary 6 For any (3 -probabilistic (2, n, 0, 1, 1)- VCS we have that 


(3 < (3* 


4 -(fc-i) 

n(n 


1 ) • • • (n 


(k~ I))' 


Proof Assume by contradiction that a probabilistic scheme with (3 > (3* 
exists. By Lemma 5, we can construct a scheme with contrast 7 > (3. Since 
(3 > (3* = 7* we get that 7 > 7*, contradicting Equation (5.1). 


5.5 Trading Pixel Expansion with Probabilities 

In the above section, the correspondence between deterministic and probabilis- 
tic schemes has been stated in Lemma 3 and Lemma 5, showing a trade-off 
between pixel expansion and probability factor. It shows that by using a large 
enough pixel expansion we can transform a probabilistic scheme into a de- 
terministic one. Indeed, on one extreme it is possible to have schemes with 
no pixel expansion, where the reconstruction relies entirely on the probability 
factor of the scheme. On the other extreme, it is possible to have deterministic 
schemes, where the reconstruction is guaranteed but a certain pixel expansion 
is required. In the next section we show how it is possible to stay in between 
the two extremes, realizing schemes for which the probability factor is traded 
for the pixel expansion. 

5.5.1 Probabilistic Schemes with Given Pixel Expansion 

Lemma 5 shows the basic technique for the construction of a deterministic 
scheme with pixel expansion equal to the cardinality r of the collections Cb 
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and Cw of the probabilistic scheme with no pixel expansion taken as a starting 
point. Extending such a technique, it is possible to obtain schemes with arbi- 
trary pixel expansion m', with 1 < in' < r. The new collections of matrices 
C' B and C' w for the resulting scheme is built by constructing in all possible 
ways matrices with m! columns from the vectors of the collections C B and 
Cw of the starting probabilistic scheme (in the particular case of m! = r, the 
resulting scheme is deterministic). We remark that Construction 1 does not 
allow repetition of the same column. It is possible to build schemes by also 
allowing repetitions of the columns; however, the resulting schemes have a 
worst probabilistic factor. Notice that it is useless to construct probabilistic 
schemes with m! > r, since if in' = r then a deterministic scheme can be 
realized. 

Construction 1 Let S be a canonical (3 -probabilistic (k,n,0,l,l)-VCS. Fix 
1 < m! < r, where r = |Cb( 5')| = |Cvu(<S')|- Construct a scheme S' whose 
collection Cb(S') (resp. Cw(S') ) consists of all the matrices of dimension n x 
m! that we can build by choosing m! vectors of Cb(S) (resp. Cw{S)). 

Notice that we also need to fix the contrast thresholds £' and h! of the new 
scheme S'. There can be several valid choices. 

To illustrate the construction, consider the following 1/3-probabilistic 
(2, 3, 0, 1, 1)-VCS S. 


f 
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For such a scheme, the parameters are p b \ b = 2/3 and p b \. w = 1/3. 


If m! = 2 is fixed, a ^-probabilistic (2, 3, -, -, 2)-VCS is obtained by applying 
Construction 1 to scheme S: 
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The thresholds of S' can be selected in different ways returning in every 
case a ^-probabilistic scheme. If values £' = 0 and h! = 1 are selected, the 
resulting probabilities for the scheme S' are p' b ^ b = 1 and pf = 2/3. For 
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I' = 1 and h' = 2, scheme S' has p b ^ b = 1/3 and p' b , = 0. As already said, 
here we are considering values satisfying the condition I’ = h! — 1. Notice that 
for the values the case C = 0 and h' = 2, some reconstructed pixels cannot 
be classified as either black or white. In such a scheme the probabilities of 
correctly reconstructing secret pixels are smaller (since some of the matrices 
are wasted with a reconstruction that is neither black nor white). We also 
remark that one could try to eliminate distribution matrices for which the 
reconstruction gives a number of black subpixels in the gap between U and 
h’\ however it is not clear whether this can be done without violating the 
security property. In the particular case above, £' = 0 and h' = 2 is clearly 
not possible (indeed we would have a perfect reconstruction of both white 
and black). One could also extend the formal model to allow this possibility; 
but then the contrast should be redefined in order to account for unclassified 
reconstructed pixels. 

The matrices M b and M w consisting of all the columns of Cb and Cw can 
be used to represent the new scheme S', since they give an efficient represen- 
tation of the collections C' B and C' w ; clearly together with Mb and Mw, the 
pixel expansion m' and the thresholds £' and h! need to be specified. 

Construction 1 starts from probabilistic schemes with no pixel expansion. 
Using Lemma 3 or Lemma 4 a probabilistic scheme with no pixel expansion 
can be obtained starting from a deterministic scheme. Hence, probabilistic 
schemes with pixel expansion can be constructed by starting from a deter- 
ministic scheme, applying first Lemma 3 and then Construction 1. 

The probabilistic schemes obtained with Construction 1 satisfy the security 
property. Indeed, consider a nonqualified set Q of participants and let C^-(S) 
(resp. C^(S)) be the vectors of Cw(S) (resp. Cb(S)) restricted to the rows 
corresponding to participants in Q. By the security property of S , C^ V (S) and 
Cg(S) are the same collection of vectors. Since the way in which Cw(S') and 
Cb(S') are constructed is the same (except that for the former we start from 
Cw{S) and for the latter from Cb(S)), also C^(S') and C^(S') are the same 
collection of matrices. Hence, the security property for S' holds. 

In this section, a formula for the probabilities of the scheme built with 
Construction 1 as a function of the probabilities of the starting scheme is 
provided. Let S' be a canonical probabilistic scheme with no pixel expansion 
and let Pb\b->Pb\vnPw\b and Pw\w be the probabilities of S. 

Fix an m! and build a probabilistic scheme with pixel expansion m! using 
Construction 1. Fix also a threshold I' , 0 < i' < m! . Fixing £! also gives 
h' = £! + 1. Notice that, even with this restriction, not all choices of £' will 
result in valid schemes. Let r be the cardinality of the collections Cw and Cb 
of S. 

The cardinality of the collections C' w and C’ B , of scheme S', is r' = r(r — 
1) • . . . • (r — m! + 1) because the first column can be selected in r ways, the 
second in r — 1 ways, and so on until the last column for which r — m! + 1 
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choices are possible. It is easy to see that r' = rn'!( r ,). An explanation of 
this expression is that the binomial coefficient gives the number of possible 
ways of choosing m! vectors among the r of the collections, and the factorial 
coefficient accounts for all the possible permutations for each choice. 

Fix a qualified set Q of participants. To compute p' b \ b {Q), the number of 

matrices of Cg(S) that yield a black reconstructed pixel is needed. Notice 
that, for a qualified set, the number of matrices (vectors) Cg(S) that would 
give the correct reconstruction of a black subpixel (i.e., a black pixel) is r-p b \ b , 
while the remaining r — r ■ p b \ b , would give a wrong reconstruction of a black 
secret pixel (i.e., a white pixel). Recall that since S is canonical, p b \ b does not 
depend on Q. Hence, the number of matrices in Cb(S') that will have a certain 
number z of black subpixels, is given by 

m'\( r ' Pb A ( r ~ r ' Pb A 
\ z J \ in' — z J 

because z vectors can be selected from the r ■ p b \ b vectors that yield a recon- 
structed black subpixel, and m! — z vectors from the i — r • p b \ b ones that yield 
a reconstructed white subpixel. Hence, 2 is constrained by 0 < z < r-p b \ b and 
0 <m' — z<r — r - Pb\bi which implies that binomial coefficients are defined. 
(By definition (^) = 1 and that (£) = 0 when b > a.) Hence, the values for 
the probabilities of the resulting scheme can be expressed as follows: 


Pb\b(Q) 

and similarly 

p'b\w(Q) 

Pw\w (Q) 

p' w \b(Q ) 
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(5.3) 

(5.4) 

(5.5) 


Since from Equations 5. 2-5. 5, probabilities of S' do not depend on the 
particular qualified set Q , it is possible to conclude that S' is canonical. 
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5.6 Constructing Probabilistic Schemes 

The construction previously described can be applied for the construction of 
novel probabilistic schemes. The starting point however is the selection of a 
particular deterministic scheme that determines the parameters of the result- 
ing scheme. Obviously, by changing the selected scheme, different probabilistic 
schemes are obtained. In the next sections we will describe some probabilistic 
schemes for the (n, n) and the (2,n) cases starting from two selected de- 
terministic schemes. In the first case a simple formula for the probabilistic 
factor can be obtained, relating /3 to the pixel expansion of the resulting 
scheme, while in the second case, the computation of the parameters results 
is more complicated and depends on the selected pixel expansion of the new 
scheme. 

5.6.1 (n, n)-Threshold Probabilistic Schemes with Any Pixel 

Expansion 

In this section a (n, n)-thresholcl probabilistic schemes with any pixel expan- 
sion is built, for n > 2 starting from deterministic scheme Sd, which is the 
(n, n)-threshold deterministic scheme of Naor and Shamir [16]. Sd has pixel 
expansion m = 2 n ~ 1 , and thresholds I = m — l and h = m. Moreover, the 
scheme consists of a white base matrix containing all vectors with an even 
(including 0) number of black subpixels and a black base matrix containing 
all vectors with an odd number of black subpixels. For example, for n = 4 the 
scheme Sd is given by: 
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Let S be the (n, n, 0, 0, 1)-VCS obtained applying Lemma 3 to scheme Sd- 
For scheme S we have that the cardinality of the collections Cb and Cw is 
r = 2 n_1 , and that p b \ b = 1 , p w \ b = 0, p w \ w = 1/2" -1 , p b \ w = 1 - l/2 n_1 . 
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Cw 


' 0 ' 


' 0 ' 


' 0 ' 


' 1 ' 


■ 1 ' 


' 1 ' 


' 1 ' 


' 0 ' 

1 

0 


0 


1 


0 


1 


1 


0 


1 


0 

1 

1 

1 

0 

1 

0 

1 

1 

1 

0 

1 

1 

1 

1 

( 

1 


o 


o 


o 


o 


1 


1 


1 



Fix an m' , 2 < m! < r, and let S 1 ' be the probabilistic scheme with pixel 
expansion in' obtained using Construction 1 from scheme S. The threshold P 
for S' also needs to be selected, remembering also that the threshold h! will 
be obtained if the assumption h! = P + 1 is satisfied. Observe that P must 
be m! — 1 because there is only one column with all white pixels and thus it 
would be never possible to get more than 1 white subpixel in a reconstructed 
pixel (equivalently always at least m' — 1 black subpixels in a reconstructed 
pixel will be obtained) . This implies that if by selecting P < in' — 1 all recon- 
structed pixels will always be considered black and thus no valid scheme can 
be obtained. To construct schemes, values P = m' — 1 and h' = in' must be 
selected. 

To compute the probabilistic factor of scheme S' it is necessary to compute 
p' b | & and p' b \ w - All the columns of the black base matrix Mb of the deterministic 
scheme Sd have at least a 1; hence, all columns of Cb{S') have at least a 1. 
Thus, in' black subpixels when reconstructing a black secret pixel are always 
returned. This means that p ' b | b = 1 and p' w ^ b = 0. To compute p' b , consider the 
white base matrix M w of scheme Sb>, which determines Cw{S')- Since M w 
has one column with all Os there will be some matrices of Cw(S') that include 
such a column. In order for a reconstructed pixel to be considered black it 
must have h' = m' black subpixels. Among the ( r ,) possible distribution 
matrices of Cw(S'), exactly ) do not include the unique column with all 
Os. Hence, 



= 1 — m' /r 


and 

P'w \w = m '/ r 

The formula expressing the probability factor of S' is then the following: 


0 


In— 1 ' 


The formula shows that there is a linear relation between the pixel expan- 
sion of the scheme and the probability factor. A probabilistic scheme with no 
pixel expansion implies a small probability factor (0 = 1 /r) and then a recon- 
structed image with many errors; the probability factor of the scheme can be 
increased by increasing the pixel expansion to obtain a better reconstructed 
image. Clearly for m! = 2 n ~ 1 one would get 0 — 1, that is, a deterministic 
scheme. 
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5.6.2 (2, n)-Threshold Probabilistic Schemes with Any Pixel 

Expansion 

In this section a (2, n)-threshold probabilistic scheme with pixel expansion, 
for n > 3 is provided, starting from the (2, n)-threshold deterministic scheme 
Sd described in [7]. Recall that So has pixel expansion m = (^j)> and 

thresholds I = (. Sj-i) and ^ = (i ”j) — ("if 2 ). The scheme has a white base 
matrix consisting of t columns of all Is and m — I columns with all Os, and a 
black base matrix consisting of all binary vectors with exactly [n/ 2J elements 
equal to 1. 

For example, for n = 4, scheme Sd has m = 6, t = 3, and h = 5 and is 
given by: 
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Let S be the (2, n, 0, 0, 1)-VCS obtained applying Lemma 3 to scheme Sd- 
Scheme S' is a canonical scheme, and the cardinality of the collections Cb and 
Cw is r = m. The values of the probabilities are pb\b = h/m, p w if, = 1 — h/m , 
Pb\w = i/tn, p w \ w = 1 — i/m. Since S is canonical the scheme S' obtained 
with Construction 1 is canonical. The value of the pixel expansion m 1 can be 
arbitrarily fixed between 1 and r. 

Consider the case of m' = 2. For such a value of m' there are only two 
possible choices for the thresholds: £' = 0, h' = 1 or £! = 1, h! = 2. It is easy 
to see from the structure of M \y and Mb that the following two properties 
hold: 

• PW: For any set Q of two participants, the matrix MS, consists of t columns 
of 2 ones and m — I columns of 2 zeroes. 

• PB: For any set Q of two participants, the matrix Mfj consists of s = (?T 2 ) 
columns of 2 zeroes and m — s columns with at least a 1 (this is because 
for a qualified set Q of 2 participants matrix M® reconstructs a pixel with 
exactly h black subpixels, hence the remaining m — h = s are white) . 

Let us now determine the parameters of the resulting scheme in the two con- 
sidered cases. 


Case l' = 0, h' = 1. 

To compute p' b ^ b , consider that in this case a reconstructed pixel is black if 
at least one subpixel is black (and white otherwise). If a qualified set Q is 
fixed, by property PB, it is easy to see that the matrices of the collection 
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C®(S') that consists of all zeroes are exactly s(s — 1). Thus, p' w | b = 
and consequently p' bjb = 1 - 

To compute p b , w , consider a qualified set Q. By property PW, the matrices 
of the collection C^(S') that consists of all zeroes are exactly (m—£)(m—£— 1). 

Tj / (m—£)(m—£— 1) i • l / i (m— £)(m— t— 1) 

Hence, p' , = 1 r — , which gives pv. = 1 — 1 r — n — • 

’ r w\ w mym— 1) ’ ^b\w m(m— 1) 

Hence, for the (2, n)-threshold scheme obtained by choosing £! = 0 the 
probabilistic factor is: 

(m — £) (to — £ — 1) — s(s — 1) 

0 to(to — 1) 


Case £' = 1, h! = 2. 

To compute p/| h , consider that in this case a reconstructed pixel is black if 
both subpixels are black (and white otherwise). If a qualified set Q is fixed, 
by property PB, the matrices of the collection Cg(S') that have at least a 1 
in each column are exactly (to — s)(m — s — 1). Thus, p ' b | b = ■ 

To compute p b \ w , fix any qualified set Q and consider that by property PW, 
the matrices of the collection C^(S') that have at least a 1 in each column are 
exactly £(£ - 1). Thus, j/ 6|t0 = ■ 

Hence, for the (2, n)-threshold scheme obtained by choosing £' = 1 the 
probabilistic factor is: 


(to — s)(to — s — 1) — £(£ — 1) 

to(to — 1) 


Compare now the value of [3 for the above two cases trying to figure out 
whether one case is better than the other, i.e. , the probabilistic factor is big- 
ger and a better quality image is reconstructed. It is possible to express the 
difference f3\ — /3 q as 




0o — 


V 7 m(^) VVn(^) 
to(to — 1) 


where ipm{x) = (to — x)(m — x— 1) +x(x— 1). The first and second derivatives 
of ip with respect to x are = 4x — 2 to and = 4, respectively. Hence, 

function ip m (x) is a convex U function of x, with a minimum at x = m/2. A 
simple algebra shows that, for n even, s = ^ ■ rk pf and £ = y an( ^ that for 
n odd, s = y ■ yy an d £ = y ' Since in both cases s < t < to/ 2, it is 
possible to conclude that 4>m{s) > ipm{£) and then 0i > f3 0 . A simple analysis 
shows that the limit of (3\ as n approaches infinity is 5/16 ~ 0.31, while the 
limit of 0o as n approaches infinity is 3/16 ~ 0.18. 

In the case of any m' Equations (5.2)-(5.5) can be used to compute the 
probabilities of probabilistic schemes, over all choices of £! and h! . Table 5.1 
gives the resulting values of the probabilistic factor 0 of S' over all possible 
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choices of £' and m' , for the case of n. Since for n = 3 scheme Sd has m = 3 
clearly for m' = 3 we get a deterministic scheme; such a scheme is obtained 
for (! = 1, h! = 2. It is worth to notice that for other choices of I' the 
probabilistic factor of the scheme is 0 meaning that no probabilistic scheme 
with pixel expansion m' = 3 can be constructed with Construction 1. For the 
case of m' = 2 i' = 1 and t! = 2 are valid choices and they both yield a 
^-probabilistic scheme. 

TABLE 5.1 

Values of (3 for scheme S' for 
n = 3. The max over each 
row is in boldface. 


m'Y',h' 

0,1 

1,2 

2,3 

1 

1/3 

- 

- 

2 

1/3 

1/3 

- 

3 

0 

1 

0 


TABLE 5.2 

Values of (3 for n = 4. The max over each row is in 
boldface. 


m'\f, h' 

0,1 

1,2 

2,3 

3,4 

4,5 

5,6 

1 

1/3 

0.333 

— 





2 

~TJh~ 

0.200 

7/15 

0.467 





3 

1/20 

0.050 

1/2 

0.500 

9/20 

0.450 




4 

0 

-TJS~ 

0.050 

4/5 

0.800 

T73“ 

0.333 



5 

0 

0 

1/2 

0.500 

1 

1/6 

0.167 


6 

0 

0 

0 

1 

1 

0 


Table 5.2 gives the resulting values of the probabilistic factor (3 of S' over all 
possible choices of i' and m\ for the case of n = 4. Notice that for n = 4 scheme 
Sd has m = 6, hence, for m! = 6 deterministic schemes can be obtained (in 
this case both I' = 3 and t' = 4 yield a deterministic scheme) . As reported in 
the table, also for m' = 5 a deterministic scheme can be obtained by choosing 
l' = 3. For the other possible choices of m 7 , the table shows in boldface the 
biggest probabilistic factor (3 found. 

Finally, Table 5.3 gives the resulting values of the probabilistic factor (3 
of S' over all possible choices of I' and to 7 , for the case of n = 5. For n = 5 
scheme Sd has m = 10, hence, m' can range from 2 to 10. As reported in 
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TABLE 5.3 

Values of /3 for n = 5. The max over each row is in boldface and e\ and e 2 
denote very small values. 


m'\£',h ' 

0,1 

1,2 

2,3 

3,4 

4,5 

5,6 

6,7 

7,8 

8,9 

9,10 

1 

3/10 

- 

- 

- 

- 

- 

- 

- 

- 

- 

2 

4/15 

1/3 

- 

- 

- 

- 

- 

- 

- 

- 

3 

19/120 

29/60 

31/120 

- 

- 

- 

- 

- 

- 

- 

4 

1/14 

44/105 

23/42 

17/105 

- 

- 

- 

- 

- 

- 

5 

1/42 

11/42 

55/84 

10/21 

1/12 

- 

- 

- 

- 

- 

6 

£l 

5/42 

23/42 

16/21 

1/3 

1/30 

- 

- 

- 

- 

7 

0 

1/30 

1/3 

5/6 

17/24 

11/60 

^2 

- 

- 

- 

8 

0 

0 

2/15 

2/3 

1 

”8715“ 

17T5 

0 

- 

- 

9 

0 

0 

0 

2/5 

1 

1 

3710 

0 

0 

- 

10 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 


the table, a deterministic schemes is obtained from m' = 8 (in such a case, 
by choosing = 4). Again the best probabilistic factor found is reported in 
boldface. 


5.7 Probabilistic Schemes with Boolean Operations 

One of the peculiar characteristics of VCS is the fact that the reconstruction 
of the secret image is done via the human visual system. This means that 
representing a black pixel as ‘1’ and the white pixel as ‘0,’ the reconstruction 
is performed via an ”OR” operation of the superposed pixels contained in 
the shares. Relaxing such an assumption, it is possible to obtain different 
classes of VCS where the secret pixel is reconstructed after performing different 
boolean operations on the subpixels contained in the shares. For example 
XOR-based VCS have been proposed in [17]. As regards probabilistic VCS, 
several proposals have been done [20, 18, 8], where the basic operation for the 
reconstruction is no more based on the OR of the shared subpixels, and both 
the distribution and the reconstruction phases are consequently modified. 

5.7.1 (2,n) Scheme for Binary Images (Wang) 

In [20], Wang et al. proposed a probabilistic (2, n)-VCS based on binary XOR 
and AND operations, denoted with ® and &, respectively. The construction 
is given in Figure 5.3. 
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Let A be the binary matrix representing the secret image. 

Distribution phase. 

The dealer: 

• generates n+1 random matrices B 1 , . . . , B n +\ ; compute intermediate 
matrices C\, . . . , C n where C; = Bi&A, for * = 1, . . . , n; 

• distributes the n shares Ai, . . . , A n where Aj = _B n +i © Ci for i = 

Reconstruction phase. A qualified set {ij,ik} of two participants 
reconstructs the secret image as follows: 

• superimpose their shares executing binary XOR operation to obtain 
A' = Aj®A k . 


FIGURE 5.1 

A construction for (2,n) Boolean probabilistic VCS. 


In Wang’s scheme, a reverse coding of the pixel is adopted, assigning ‘0’ 
to black pixel and ‘1’ to white pixels. In this scheme it is easy to see that 
a black pixel in the secret image will be always mapped to a black pixel in 
each of the computed shares Aj because of the AND operation performed in 
the computation of the Cj (for a ‘0’ pixel, Cj = Bjlk 0 = 0) and the XOR 
operation in the reconstruction phase (the contribution for Cj = 0 means that 
Aj = B n+ 1 ® Cj = B n+ 1 and then A' = Aj ® A k = B n+1 ® B n+1 = 0). The 
probabilities of reconstructing a black pixel are then puf, = 1 and p w \ f, = 0. 
A white pixel will be reconstructed on the basis of the result of the XOR 
operation performed on the two matrices Bj and B^, which are randomly 
selected. Then p w \ w = pu w = 1/2. Hence, the construction returns a f3 = 1/2 
probabilistic scheme with contrast 1/2. 

The above presented scheme has been modified by Ulutas et al. in [18] and 
Chang et al. in [8]. In the first work the construction is modified by adding a 
mechanism to augment the probability of selecting a white (black) pixel given 
that a white (black) pixel was present in the secret image. Basically, matrices 
Bj are no more randomly generated as in Wang’s scheme, but are selected in 
two different sets, one for white pixels and the other for black pixels, in order 
to maximize the probability of reconstructing a pixel of the right color. Then 
a random matrix R of the same size of the secret image is generated and used 
to compute the share. The reconstruction phase is not modified. The modified 
scheme is given in Figure 5.2. 

In Chang et al’s construction, a voting strategy is adopted to apply the 
Wang method to grayscale images [8]. In such a method, for each original 
pixel, the binary representation of its grayscale value is considered, and for 
each bit composing the representation, the Wang scheme is executed and 
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repeated 2m + 1 times in the generation phase. In the reconstruction phase, 
the voting method is used to recover the best result out of the shared bits in 
order to restore the original grayscale value of the pixel. 


Let A be the binary matrix representing the secret image. 

Distribution phase. 

The dealer: 

• generates a white image (D) and n shares B i , . . . , B n with D as secret 
image; compute intermediate matrices C\, . . . , C n where C; = R&A, 
for i = 1, . . . , n; 

• generates a random matrix R ; 

• distributes the n shares Ai , . . . , A n where Ai = R®Ci for i = 1, . . . , n 


FIGURE 5.2 

Ulutas et al. [18] construction for (2,n) Boolean probabilistic VCS. 


5.7.2 (n,n) Scheme for Binary Images (Wang) 

A construction similar to the one above described, was proposed by Wang also 
for a (n,n) probabilistic VCS. The construction is given in Figure 9.6 


Let A be the binary matrix representing the secret image. 

Distribution phase. 

The dealer: 

• generates n — 1 random matrices B i, . . . , B„_i; 

• distributes the n shares Ai, . . . , A n where Ai — B i, A; = R,_i © Bi, 
and A n = B„_i © A. 

Reconstruction phase. The n participants reconstruct the secret im- 
age as follows: 

• superimpose their shares executing binary XOR operation to obtain 

A' = Ai © A 2 • • • © A„. 


FIGURE 5.3 

A construction for (n,n) Boolean probabilistic VCS. 

In such a scheme it is easy to see that a black pixel in the secret image 
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will be always mapped to a black pixel in each of the computed shares A t 
because of the and operation performed in the computation of the Cj (for a 
’0’ pixel, Cj = Bj & 0 = 0) and the XOR operation in the reconstruction 
phase (the contribution for Cj = 0 means that A,j = B n+ \ ® Cj = B n+ 1 
and then A! = Aj © Aj, = B n+ 1 © B n+ 1 = 0. Then p b \ b = 1 and p w \ b = 0. 
A white pixel will be reconstructed according to the pixel returned after the 
XOR between the two matrices f?; and Bk , which are randomly selected. Then 
Pw\w = Pb\w = 1/2. Hence, the construction returns a /3 = 1/2 probabilistic 
scheme with contrast 1/2. 

The same construction has been extended by Wang et al. in [21] to deal 
with grayscale images. Basically each pixel is coded with a binary string g — 1 
bits long, where g denotes the gray level number, and having a number of ”l”s 
equivalent to the Is present in the binary string obtained by the grey level g 
(without respecting the order). A pixel having grey level k in a range from 0 
to g — 1, is represented by a binary string having g — k ’0’s and fc — 1 ’l’s. The 
construction returns a probabilistic scheme with m = g — 1. 


5.8 Conclusions and Open Problems 

The probabilistic model for VCS schemes has been first described in Yang [22], 
where the reconstruction of the secret pixel has been given in probabilistic 
terms, no more guaranteeing the correctness property of the traditional VCS 
schemes. A generalization of the model has been given then in [11], where 
probabilistic schemes with pixel expansion have been described, showing that 
there is a one-to-one correspondence between probabilistic schemes with no 
pixel expansion and deterministic schemes and that such a one-to-one map- 
ping trades the probabilistic nature of the scheme with the contrast of the 
deterministic scheme. Probabilistic schemes with pixel expansion can be ob- 
tained from deterministic schemes and their probabilistic factors can be stud- 
ied. While for (n, rc)-threshold schemes it has been proved that there is a 
linear relation between the pixel expansion and the probabilistic factor, for 
(2, n)-threshold schemes no closed expression for the probabilistic factor has 
been found. Finally, a probabilistic model has been extended and alternative 
operations (instead of OR) have been considered for the distribution of the 
shares and the reconstruction of the secret images. 
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6.1 Introduction 

A (k,n) visual cryptography (VC) scheme [16] is a type of secret sharing 
scheme with the special property that a secret image can be recovered visually 
by the human eye and does not require any calculation on a computer. How- 
ever, the recovered secret image has low quality. In this case, some researchers 
attempt to consider other different approaches to improve the quality (con- 
trast) of the recovered image. 

Lee et al. [12] presented a VC scheme using an XOR process to share a bi- 
nary image. Since phase masks were placed on any path of the Mach-Zehnder 
interferometer for reconstruction, the method is impractical and expensive 
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[17]. Biham and Itzkovitz [2] investigated a VC system based on passive light 
polarization. This is more flexible than the Naor and Shamir schemes but 
cannot be modeled by an XOR [17]. Tuyls et al. [17, 18] gave a VC system 
that uses the polarization of light. The operation of the VC system is mathe- 
matically described by an XOR operation. In Section 6.3, we will show that a 
(n,n)-VC scheme with optimal resolution and contrast exist, and that (2 ,n)- 
VC schemes are equivalent to binary codes. Three explicit constructions for 
general k out of n schemes are also introduced [17, 13]. 

Viet and Kurosawa [21] noticed the phenomenon that most copy machines 
nowadays can change a black image into a white one and vice versa, then 
first gave a VC scheme with reversing for binary image. In the VC scheme 
with reversing, a dealer needs run the distribution phase of a VC scheme c 
times (with c arbitrary constant), hence requiring each participant to held 
c shadows. The almost ideal contrast of a recovered secret image is almost 
obtained for a large number of runs c. Cimato et al. [7] presented two ele- 
gant construction methods to improve the contrast and pixel expansion of 
the scheme in Reference [21]. In order to reduce run times of two schemes 
[21, 7], Yang et al. [25, 26] overcame the weakness of reversing only a based 
perfect VC scheme and first introduced a nonperfect black VC scheme, this 
approach uses a Boolean XOR operation for decoding. Reducing the stacking 
and reversing operations and minimizing number held by each participant, 
Hu and Tzeng [10] proposed an ideal contrast VC scheme with less reversing 
and stacking operations in only two runs. The scheme needs to perform XOR 
operations to decode the secret image. In section 6.4, we will introduce Yang 
et al.’s scheme and Hu and Tzeng’s [25, 26] scheme with ideal contrast. 

The construction of the above schemes is all based on basis matrices, so 
they may suffer pixel expansion and loss of contrast. Probabilistic VC schemes 
are proposed in [11, 24, 6] with no pixel expansion. However, the recovered 
secret image has low contrast. Wang et al. [23] proposed two secret sharing 
schemes based on a Boolean operation and the recovering operation is XOR. 
One scheme is (2 ,n) for the binary image, and the other is (n, n) for the 
grayscale image. Both have no pixel expansion. Chao and Lin [5] improved 
Wang et al.’s [23] scheme in order to obtain a (k, n ) scheme, which is fast and 
with a reasonable pixel expansion rate. In section 6.5, we introduce the (2, n), 
(n,n), and (k,n) schemes. 


6.2 Preliminaries 

In a black and white (k, n)-visual cryptography (VC) scheme [16], the secret 
image consists of a collection of black and white pixels and each pixel is 
subdivided into a collection of m black and white subpixels in each of the n 
shares. These subpixels are printed in close proximity to each other so that the 
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human visual system averages their individual black and white contributions. 
The collection of subpixels can be represented by an n x m Boolean matrix 
S = [s,;j] , where the element Sij represents the j-tli subpixel in the z-th share. 
A white subpixel is represented as a 0, and a black subpixel is represented 
as a 1. The white subpixels are let through the light while black subpixels 
stop it. Sij = 1 if and only if the j-th subpixel in the z-tli share is black. 
The gray level of the combined share obtained by stacking shares , i 7 

is proportional to the Hamming weight (the number of l’s in the vector V) 
H(V) of the OR-ed (”OR” operation) m-vector V = OR(i\ , ••• , z 7 ). Based 
on the definition of Naor and Shamir [16], Verheul and van Tilborg [20] gave 
a more general definition. Following the notation from [16, 20], a definition 
of k out of n XOR-based visual cryptography scheme is given by Tuyls in 
Reference [17]. A (k, n) VC scheme S = (Co, C\) consists of two collections of 
n x mn binary matrices Co and C\. To share a white (black) pixel, the dealer 
randomly chooses one of the matrices in C'o(C'i) and distributes its rows as 
shares among the n participants of the system. The following is the definition. 

Definition 1 [20] Let k, n, n, in, l be positive integers satisfying 1 < k < n 
and m > h > l. Let Z(v) be the number of 0 ’s in the vector v. A [(k,n); m, h, l\ 
visual cryptography (VC) scheme consists of two collections of n x m Boolean 
matrices Co and C\ such that: 

1. For any s € Co, the XOR v of any k of the n rows of s satisfies 
Z(v) > h. 

2. For any s £ C i , the XOR v of any k of the n rows of s satisfies 
Z(v) < l. 

3. For any i\ < ii < • • • < it in {1, 2, • • • , n} with t < k the two col- 
lections of txm matrices Dj for j £ {0,1}, obtained by restricting 
each nx m matrix in Cj, to rows i\,in,--- ,it are indistinguish- 
able in the sense that they contain the same matrices with the same 
frequencies. 

The number h and l are called the white level and black level, respectively, 
of the scheme. The parameter m is called the block length or pixel expansion 
and determines the resolution of the scheme. The contrast a is defined as 
a = -j 'ipfpf. Note that a £ [0,1] and a is maximal when l = 0. A scheme 
with 1 = 0 are called maximal contrast schemes. When a = 1, the contrast is 
defined as an ideal contrast. 

The following symmetry property follows very easily and is therefore stated 
without proof. 

Proposition 1 [17] Let S = (Co,C\) be a [( k,n);m,h,l } VC scheme. Let 
Ci be obtained from Ci by replacing zeroes by ones and vice versa. If k is 
even, then the scheme (Co,Ci) is a [( k,n)\m,h,l \ scheme as well. If k is odd, 
then (Co, Ci) is a [(k,n);m,m — l,m — h] scheme with contrast a given by 
a = (h — l)/(2m — l — h). It follows that a > a whenever l + h > in. 
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6.3 Visual Cryptography Scheme Using the Polarization 
of Light 

In this section, we will introduce XOR-basecl visual cryptography scheme. 
They are constructed using basis matrices and the secret image is recovered 
by an XOR certain number of shares. We will show how to construct (2, n), 
(n, n), and ( k,n ) XOR-based visual cryptography schemes as follows. 

6.3.1 (2, n) Scheme 

In this section, we show how to construct a (2 ,n) XOR-basecl visual cryp- 
tography scheme. The (2, n) scheme is equivalent to binary error-correcting 
codes. By a (m, n, d) code, that is, a binary code of length to consists of n 
words and a minimum Hamming distance of at least d. 

Theorem 1 [17] Let m, l and h he positive integers such that l < h < m. 
The three following statements are equivalent. 

(i) A [(2 ,n);m,m,l\ VC scheme exists. 

(ii) A [(2,n);m,h,l\ VC scheme exists. 

(Hi) A binary (m,n,m — l) code exists. 

Proof: It is clear that (i) implies (ii). 

In order to show that (ii) implies (iii), let S = (Co, C \ ) be a [(2, n); m, h, l } 
VC scheme. Take a matrix A\ £ C\ and let C consist of the rows from A\. As 
S' is a [(2 ,n);m,h,l\ VC scheme, the Hamming distance between two words 
from C is at least to — l. Consequently, C is a (m, n, to — l) code. Finally, to 
show (iii) implies (i), let C be a binary (to, n, to — l) code. For c € C, let A(c) 
denote the n x m matrix for which each row equals c. Moreover, let B be an 
nxm matrix containing each word from C as a row, and for 0 < i < n — 1, let 
B(i ) be the matrix obtained by a cyclic shift of the rows of B over i positions. 
We claim that (Cq,C\) = ({A(c)\c € C}, {H(0), R(l), • • • ,B(n — 1)}) is a 
[(2, n ) ; m, to, l] scheme. It is clear that both collections contain n matrices, 
and that in each row, each word from C occurs in one matrix from Cq and 
in one matrix from Ci, showing the indistinguishability. The sum of any two 
rows from a matrix in Co equals 0. Finally, the Hamming distance between 
any two rows of a matrix from C\ is at least to — l, showing that the XOR of 
these two rows contains at most to — (to — l) = l zeros. ■ 

An example is given as follows. 

Example 1 Let C he a binary (3,3,2) code containing words 100,010 and 
001. Construct Co and C\ as follows: 

( [1 0 0] [0 1 0] [0 0 in 

Co = < 1 0 0,0 1 0,0 0 1 \ , 

{ |_i o oj [o 1 oj [o 0 lj J 
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Ci 


'1 

0 

o' 


'0 

1 

o' 


'0 

0 

1' 

0 

1 

0 

7 

0 

0 

1 

7 

1 

0 

0 

0 

0 

1 


1 

0 

0 


0 

1 

0 


(Cq, Ci) is a [(2, 3); 3, 3, 1] scheme. The contrast a 


( h-l ) _ 2 
h+l 4 


1 

2 ’ 


6.3.2 (n, n) Scheme 

In this section, we show how to construct a (n, n) XOR-based visual cryptog- 
raphy scheme. 

Proposition 2 [17] Let Co and C i be the set of all binary vectors of length n 
with even, odd number of ones, respectively. Then (Co, Cl) is an [(n, n); 1,1,0] 
scheme. 

An example is given as follows. 

Example 2 Let Cq and Ci be 


r 

'o' 


'1' 


'1' 


'O' 

1 ( 

A' 


'o' 


'o' 


'1' 

II 

Cj 

0 

7 

1 

5 

0 

5 

1 

h 

ii 

0 

5 

1 

7 

0 

7 

1 

l 

0 


0 


1 


1 

J l 

0 


0 


1 


1 


(Cq, Ci) is a [(3, 3); 1, 1, 0] scheme with contrast a = = 1. 


6.3.3 (k, n ) Scheme 

In this section we will introduce three (k, n) XOR-based visual cryptography 
schemes. Construction 1 and Construction 2 are given by Tuyls (see more 
detail in Reference [17]). Construction 3 comes from Droste’s OR-based visual 
cryptography [9] and Liu et al. [13] shows that it is also a ( k,n ) XOR-based 
visual cryptography scheme. 

Before introducing Construction 1 and Construction 2, some definitions 
and theorems will be given, which are used in both constructions. 

For describing the constructions, we use the following notation. If A is a 
binary matrix, then P(A) is the multi set of matrices obtained by permuting 
the columns of A. Moreover, we use the concept of (fc, n) pairs, defined as 
follows. 

Definition 2 [17] A pair (A, B) of binary n x m matrices is called a ( k,n ) 
pair if there exist numbers a i, • • • , and b\, ■ ■ • , &*, such that 

1. For each i with 1 < i < k, the weight of the sum of any i rows from 
A equals ai and the weight of the sum of any i rows from B equals 
hi, and 

2. ai = bi for 1 < i < k, and au yf bk- 
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The importance of this definition stems from the following theorem. 

Theorem 2 [17] If (A ,B) is a ( k,n)-pair of n x m matrices, then 
(P(A), P(B)) is a [( k,n);m,h,l\ VC scheme with h = ma x(m — ak,m — bk) 
and l = min(m, — ak,m — bk). Here, ak and bk denote the weight of the sum 
of any k rows from A and B, respectively. 

Some notations are given here for later use. For a binary vector v of length 
m, we define Z(y) as the number of zeros in v, and H{v) as its number of ones. 
Moreover, we define the unbalance <5(v) of v by <5(v) = Z(v) — H(v). Note 

m 

that <5(v) = m — 2 H(v). For later use, we also observe that S(v) = J2 

j'=i 

With each binary n x to matrices A we associate two vectors (5(A) and N(A) 
of length 2 n , with the components indexed by binary vectors of length n. 
For each binary vector x of length n, the x-th component (5 X (A) of (5(A) is 
defined as <5 X (A) = (5(x T A), the unbalance of the sum of the rows in A whose 
index i satisfies ay = 1; also, the x-th component 7V X (A) of N(A) is defined 
as the number of columns of A that are equal to x. Lemma 1 will show that 
the vectors (5(A) and N(A) can be computed from each other. To make this 
precise, define the 2" x 2" matrix H by if(x, y) = (— l)^ x-y \ where x, y are 

n 

binary vectors of length n and (x, y) = ^ x,y t denotes the inner product of 

i = 1 

x and y. Then we have the following lemma: 

Lemma 1 [17] 

1. The matrix H is a Hadamard matrix, that is, HH T = 2 n I. 

2. The vectors (5(A) and N(A) are related by <5(A) = HN(A). 

We are now in the position to prove a generalization of Theorem 2. Before 
stating it, we need one more notation: if A is a n x m matrix, then w(Aj) 
denotes the weight of the sum of the rows of A indexed by I. Note that 
w(Aj) = 2 (to — (5 X (/)(A)), where \{I) is the characteristic vector of the set I. 

Theorem 3 [17] Let A and B be n x m matrices such that for each I C 
{1,2, ••• ,n} of size at most k — 1, w(Aj) = w(Bi). Assume moreover that 
there exist integers h and l such that h > l and that for each I C {1, 2, • • • , n} 
of size k, to — w(Aj) > h and m — w(Bj) < l. Then (P(A), P(B)) is a 
[(fc, n); to, h, l } VC scheme. 

Proof The only nontrivial thing we have to prove is the indistinguishability. 
Let / = {*!,.> ■■ ,i t } be a subset of {1,2, ••• , n} of size t < k. Let A and 
B denote the restrictions of A and B to the t rows indexed by I. Let x = 
{x\, ■ ■ ■ ,Xt} be a binary vector of length t, and let x be the binary vector of 
length n for which entry ij is equal to Xj for j = 1, 2, ■ ■ ■ , t, and whose other 
entries equal zero. It is clear that (5 X (A) = <5 X (A). As x has weight at most t, 
we find, using properties of A and B, that <5 X (A) = S X (B). 
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Hence, by Lemma 1, the number of columns N y (A) in A and the number of 
columns N y {B) in B of type y = {yoi • • ■ , Dt-i} are equal for all binary vectors 
y of length t. As a consequence, the matrices A and B are equal up to a col- 
umn permutation, which readily implies indistinguishability in the rows under 
consideration in the multisets P(A) and P(B). ■ 


Construction 1 

Now an explicit construction of (k, n) VC schemes for all n and all k 
with 1 < k < n will be given below. According to Theorem 3, it is sufficient 
to construct (fc,n)-pairs for all such n and k. We will obtain such pairs by 
concatenation of matrices from a fixed collection of building blocks. 

For each n and w with 0 < w < n, we let the nx | ) -matrix C w consist 

\w 


of all the 


different 0 — 1 column vectors of weight w, in any order. 


In the sequel, we will need an explicit expression for the weight of the sum 
of any j rows from C w . In Lemma 2, we state the result. Here and in what 

CP 


follows, we will use the standard convention that 
k > n. 


= 0 whenever k < 0 or 


Lemma 2 [17] The weight of the sum of any j rows, 1 < j < n, from C w 
does not depend on the choice of the rows and is equal to Mj tW , where 

E(0(rA)- 

i odd v 7 v 7 

Let A = (Ao, • • • , A„) T be a vector of length n + 1 with nonnegative integer 
entries. We define the matrix C(A) to be the matrix consisting of the concate- 
nation of Ao copies of Co, Ai copies of Ci, • • • , A„ copies of the matrix C n . It is 

clear that c 0 (A), the number of columns of C(A), satisfies C 0 (A) = X w 

W 

According to Lemma 2, the weight of the sum of any j rows of C( A) equals 
Cj( A), where 

.*<*)- E*-E (9 (::0- 

w i odd x 7 x 7 

Hence, if we define c(A) = (co(A),--- ,c„(A)) T , then the above can also be 
written as c(A) = MX, where M is the (n + 1) x (n + 1) matrix with entries 

the Mj iW as defined in Lemma 2 for j > 1 and with AIo,w = • Now 

suppose that A and ^ are nonnegative integer vectors such that MX and Alp 
agree in position 0, 1, • • • , k — 1, but differ in position k. Then (C(A), C(p)) 
is a ( k,n ) pair of matrices to which we can apply Theorem 2. The way to 
find such vectors A and p is described in Theorem 5, which uses Lemma 3, 
Corollary 4, and Lemma 4 below. 
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Lemma 3 [17] For 1 < j < n, 1 < w < n, we have that M :hw = 

i '- 2 **- 1 (0 ( r 4 - 


The following corollary is a direct consequence of Lemma 3. 


Corollary 4 Let R and L be the matrices defined as Rk,w = 

0 < k, w < n and Lq,o = 1, L?:, o = Lo,j = 0 if i > 0, and Lj tk = 
if 1 < j,k < n. Then M = LR. 


( n — k\ r 
[w-k) f ° r 

(- 2 )‘-‘ (() 


We define the (n + 1) x ( n + 1) matrix S by Sij 



Lemma 4 [17]The matrices R and S are inverses of each other. 


Theorem 5 [17] Let 1 < k < n — 1. Let 9 = (0 0 , 0i, ■ ■ ■ , 6 n ) be an integer- 
valued vector such that 9j = 0 */ 0 < j < k — 1, and Ok ^ 0, and let f> := SO. 
For 0 < j < n, we define 


A j = max(0, f>j) and Pj = — min(0, <fj). 

Then A and p are vectors with nonnegative integer entries, and ((7(A), C(p)) is 
a ( k,n ) pair. The parameters of the corresponding [(k,n);m,h,l\ VC scheme 
satisfy the following equations: 

m=l±\<t> w \(:), h - l = 2 k - 1 \0kl 

Z w=0 ^ ' 

and /i + i = m + ^ ^ 5Z(-1)* ^ • 

?«=0 i V / V / 

Proof As S' has integer entries, has integer entries, hence A and p have 
nonnegative integer entries. Using Corollary 4, Lemma 4, and the fact that 
4> = A — p, we find that 

c(A) - c{p) = MX - Mp = M ( A - /r) = Lie] = LRSO = L0. 

As L is a lower triangular matrix, and 0j = 0 if j < k, it follows that Cj(A) — 
Cj(p) if 0 < j < k — 1, and that 

h-l= |c fe (A) - c k (p) | = \L ktk 0 k \ = 2 k ~ 1 \0 k \. 

Moreover, 2m = co(A) + Co(p ) = co(A + p) = co(|</>|), and similarly (m — h) + 
(m-l) = c fc (A + p) = c k {\(j)\). ■ 

We will give an example to illustrate the construction. 
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Example 3 Take 9 = (0, • • • , 0, 1, 2, • • • , n — k,n — k + 1) T . As (f> = S6, we 
have by definition 

n-i / _ A 

0i= E (-irf 

v=k—i— 1 ' ' 


If k = 3, £/ien 0 = (2 — n, 1,0, 0, • • • , — l,n — 2). Consequently, A = 
(0, 1, 0, • • • , 0, n — 2) and p = (n — 2, 0, • • • , 0, 1, 0). That is to say, A = C( A) 
consists of the n x n identity matrix and n — 2 columns of weight n, while 
B = C(p) consists of n — 2 all- zero columns and furthermore contains each 
column of weight n — 1 once. It is clear that A and B both contain 2 n — 2 
columns. Straightforward computations show that a\ = bi = n—1, a2 = b 2 = 2, 
03 = n+1, 63 = ?z— 3. As a consequence, we obtain a [(3, n); 2n — 2, n+1, n— 3] 
EC scheme with a = 2/(n — 1). 

Construction 2 

In general, it seems hard to give manageable expression for the physical 
parameters of the schemes obtained with Construction 1. Tuyls [17] gave an- 
other explicit construction of a (k, n ) VC scheme that has the virtue that the 
physical parameters of these schemes can readily be computed in Reference 
[17]. For constructing these matrices, they used maximum distance separable 
(MDS) codes over GF(q), the finite field with q elements. An [n, k ] MDS code 
over GF(q) consists of q k vectors of length n with entries from GF(q) such 
that any two codewords have a Hamming distance of at least n — k + 1. It 
is known that such a code exists whenever q + 1 > n. Therefore, we choose 
q > n — 1. 


Lemma 5 [17] Let C be an [n,k] MDS code over GF(q). In any set of k 
positions, each of the q k possible patterns occurs in exactly one of the words 
ofC. 

Proof Fix k positions, two codewords that agree in these positions, differ 
in at most n — k positions. We conclude that each of the q k patterns agrees 
with at most one codeword. As the number of patterns equals the number 
of codewords, each pattern agrees with exactly one codeword in the given 
positions. ■ 

Let C be an [n,k] MDS code over GF{q). Let U(C ) be an n x q k matrix 
over GF{q) in which each word from C occurs as a column once, and let A(C) 
be the binary n x q k matrix obtained from U(C) by replacing each nonzero 
symbol in GF(q) by a ‘1,’ and the zero symbol in GF(q) by a ‘0.’ 

Proposition 3 [17] Let 1 < j < k, the sum of any j rows of A(C) has weight 

V 'V'(2 qC. 

Proof Consider j rows from U ( C ) . Lemma 5 implies that each of the <fi pos- 
sible patterns occurs in these j positions in q k ~l words from C . The number 
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of patterns with w nonzero elements equals (<Z ~ l) w . Each such pat- 

tern yields a column in A(C) with exactly w ones in the j prescribed rows. 
Consequently, the number of ones in the sum of the j rows from A(C) under 
consideration equals 

Q k ~ j E (i) ~ ir = \ qk ~ 3 ^ q - 1 + 1 - !) j )- 

w odd ' ' 


Proposition 4 [17] The sum of any k+1 rows of A{C) has a weight q k+1 — 
(2 -q) k+1 ) - ^2 k . 

Proof Consider k+1 positions in C . Any two distinct words from C differ 
in at least two of these positions. That is, restricted to these k + 1 positions, 
C is a [k + 1, k, 2] code over GF(q). The number of words of weight w in such 
a code equals 



The weight of the sum of the rows of A(C) corresponding to the k + 1 chosen 
positions is obtained by summing the above expressions of b w over all odd w. 


Theorem 6 [17] Let 2 < k < n — 1, and let q be a prime power not smaller 
than n—1. There exists a [( k , n ); q k , |( q k + (—l) k (q — 2) k + (q— l)2 fc ), |( q k + 
(— l) fe (9 — 2) fc )] VC scheme with contrast (q — 1)2 k ~ 1 /[q k + (— 1 ) k (q — 2) k + 

(q- 1)2*" 1 ]. 

Proof Let C be an [n, k\ MDS code over GF(q ), and let D be an [n, k — 1] 
MDS code over the same held. In the notation of this section, let A equal 
A{C~), and let B equal the concatenation of q copies of A(D). By combining 
the above results, (A, B) is a ( k,n ) pair, and ( P(A),P(B )) is a VC scheme 
with parameters as claimed in the theorem. ■ 

Bounds on the parameters m, h and l 

Tuyls provided bounds on the parameters of a (k, n)-VC scheme. We start 
by proving that maximal contrast schemes (l = 0) do not exist. We note that 
for OR-based schemes maximal contrast schemes can always be constructed. 

Proposition 5 [17] Let 3 < k < n. There exists neither a [(fc, n); to, h, 0] VC 
scheme, nor a [(k, n); to, to, l\ VC scheme. 
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Proof Let S = (Co,Ci) be a [(fc, n); m, h, 0] VC scheme and let B e C\. 
Denote by cr 1 , a 2 two arbitrary rows in B. Since n — 2>k — l,B contains (at 
least) k — 1 more rows. We denote these rows by cr 3 , • • • , a k+1 . Since S' is a 
scheme with l = 0, the XOR of cr 1 , cr 3 , •• • , a k+1 is the all-one vector, as is the 
XOR of cr 2 , cr 3 , • • • , a k+1 . If follows that cr 1 = cr 2 , so all rows of B are equal. 

Next, let A G C 0 and consider row i and j of A. As k > 3, the indistin- 
guishability property of Definition 1 implies that there is a B £ C\ that agrees 
with A in these rows. As all rows of B are equal, the *-th and j-th row of A 
are equal. Since i and j are arbitrary, all rows of A are equal, so A = B, a 
contradiction. 

The second statement follows from an analogous reasoning. ■ 

The next two propositions show that XOR-basecl VC schemes with odd 
and even k fundamentally differ. 

Proposition 6 [17] Let k be odd, and let k < n. For each e > 0, there are 
integers m, h, and l such that l/m < e and a [(k, n); m, h, l ] VC scheme exists. 

Proposition 7 [17] Let k be even, and let k < n. If a [( k,n);m,h,l } VC 
scheme exists, then l/m > l/(fc+ 1). 

Corollary 7 [1 7] For even k < n, the contrast of a k out of n VC scheme is 
at most k/(k + 2). 

Proof Let S’ be a [(fc, n); m, h, l ] scheme. By definition, the contrast a is equal 
to (h — l)/(h+l). It is clear that a is increasing in h, and so a < (m—l)/(m+l). 
As ( m—l ) / (m+l) is decreasing in l, we obtain an upper bound on a by plugging 
in the upper bound for l from Proposition 7. ■ 

Lemma 6 [17] Let k be an even integer. Let B be a binary matrix with n 
rows such that the sum of any k rows from B differs from 0. Then B has at 
least n — k + 2 distinct rows. 

Lemma 7 [17] Let (Co,Ci) be a [( k,n);m,h,l ] VC scheme with k> 3, and 
let c\ and c-i be two rows of a matrix in Cq and hence also two rows of some 
matrix in C\. Then, the Hamming distance between c\ and Ci satisfies 

d(ci,c 2 ) < min{2Z, 2 (in — h)}. 

Proposition 8 [17] Let k be even, k > 4. If a [( k,n);m,h,l ] VC scheme 

min(Z,2(m— h)) 

exists, then n — k + 1 < ^ 

i = o 

Proof Let k be even, k > 4, and let S = (Co, Ci) be a [( k , n); m, h, l ] scheme. 
Let B be a matrix in Ci. As l m, no k rows of B add to the all-zero word. 
Lemma 6 implies that B has at least n — k + 2 distinct rows. Since according 
to Lemma 7, all rows from B have a Hamming distance at most 2 (m — h) to 

2 (m-h) / m 

its top row, we obtain n — k + 2 < Y] ( ■ 

i= o V 1 
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Now we assume without loss of generality that the top n — k + 1 rows 
of B are distinct. Let c be the sum of the k — 1 bottom rows of B. For 
1 < i < n — k + 1, the sum of c and the z-th row of B contains at most l 
ones; that is to say, the z-tli row of B has a Hamming distance at most l to 
the complement of c. As the n — k + 1 top rows of B are distinct, n — k + 1 is 
at most the number of vectors at distance at most l from the complement of 

c, son-jfc + 1 < £ f m V ■ 

z=o V 1 J 

Construction 3 

Droste [9] proposed an algorithm to construct a (k, n)-VC scheme under 
the OR operation. Liu et al. [13] proved that the basis matrices constructed 
by that algorithm are also the basis matrices of a (k,n)-V C scheme under the 
XOR operation. Droste’s algorithm can be described as follows. 

For easy specification, we call a column of a Boolean matrix with an even 
number of l’s even and otherwise odd. If B is a Boolean matrix, we define 
P(B) as the multiset of matrices obtained by permuting the columns of B , 
i.e., each permutation corresponds exactly to one element of P(B). 

The following lemma will be needed later. 


Lemma 8 [9] Let Bq and B\ he two n x m Boolean matrices so that there 
exist m — 2 fc ~ 1 column vectors V\, ■ ■ ■ ,v m _ 2 k - i £ {0, 1} A ’ with the following 
property: for every {zi, • • • , ik} C {1, • • • , n} the restriction of Bq (resp. B\) to 
the rows Zi, • • • ,ik contains every even (resp. odd) column of length k exactly 
once and all columns V\, ■ ■ ■ ,v m _ 2 *-i. Then P(Bq) and P(B{) are a k out of 
n secret sharing scheme with relative contrast 1/m; here the contrast is defined 
as a = — . 

m 

The main idea for construction is to start with an empty matrix (which 

has no columns) and, for various q £ {0, • • • , n} and all columns, which 

have exactly q l’s. Because of the symmetry of this construction with respect 
to rows, all restrictions of such a matrix of k rows contain the same columns. 
And one can exactly determine which columns they contain. 


Lemma 9 [9] For q £ {0, • • • ,n} let B be an n x 


Boolean matrix that 


contains every column with q l’s exactly once. Then every restriction of B to 

f n — 


k rows ( with k < n) contains every column with p l’s exactly 
(where p £ max{0, q — (n — k), ■ • ■ , min(g, k)} ). 


q-p 


-times 


Lemma 9 shows a possibility to expand a matrix, if we add to all its 
restrictions every column with p l’s exactly once: just add all columns with 
q = p or q = p + n — k l’s to the entire matrix. So a subroutine ADD(p, B) 
adds to each restriction of k rows of a matrix B every column with p l’s by 
adding columns to the entire matrix. 
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Step 1: If p < k — p, add all the columns with q = p l’s to B. 

Step 2: If p > k — p, add all the columns with q = p + n — k l’s to B. 


The subroutine makes it easy to construct basis matrices Bq (resp. B\) 
whose restrictions always contain every even (resp. odd) column. But besides 
these columns, every restriction of Bq and B\ can contain remaining columns 
(which are the same for all restrictions of one matrix because of the construc- 
tion principle). To be appropriate for a k out of n scheme these remaining 
columns have to be the same for Bq and B\ (see Lemma 8) . So the remaining 
columns of every restriction of Bq, which are not remaining columns of every 
restriction of B i, called the rest of Bq, have to be added to every restriction 
of B\ and vice versa. In most cases, these added columns will create new rests 
that cause new columns to be added. 

Droste’s algorithm 


Step 1: For all even p g {0, ■ • ■ , k}, call ADD(p, Bo). 

Step 2: For all odd p e {0, • • • , k}, call ADD(p, Bi). 

Step 3: While the rests of B 0 and Bi are not empty: 

(a) Add to Bq all columns adjusting the rest of Bi by calling ADD. 

(b) Add to Bi all columns adjusting the rest of B 0 by calling ADD. 


Theorem 8 shows that Droste’s algorithm also generates a ( k , n)-VC 
scheme under the XOR operation, by Liu et al. [13]. 

Theorem 8 [13] Droste’s algorithm generates the basis matrices of a ( k,n)~ 
VCS, B 0 and Bi , under the XOR operation. 

Proof We need to prove that the basis matrices Bq and B\ satisfy the contrast 
and security conditions of Definition 1. 

First, for the contrast condition, we need to prove that the Hamming 
weight of the stacking (XOR operation) of any k out of n rows of Bq is less than 
that of B\. Denote Bq (resp. B f) as the submatrix generated by restricting to 
arbitrary k rows of Bq (resp. B\). According to the Steps 1 and 2 in Droste’s 
algorithm, it is clear that all the even (resp. odd) columns appear in Bq (resp. 
odd). Denote Iq (resp. if) as the matrix whose columns are all the even (resp. 
odd) columns of length k. Because Droste’s algorithm terminates when the 
rests of Bq and B\ are empty, it implies that the remaining columns of Bq 
and Bi are the same, that is, Bq\Iq = B^\I f. Denote R as the remaining 
columns of Bq and B\, we have Bq = Iq U R , B\ = if U R. Because the XOR 
(operation) of the entries of an even (resp. odd) column is 0 (resp. 1), we have 
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the result that the Hamming weight of the stacking (XOR operation) of the 
rows of Bq is less than that of B f . Hence, the contrast condition is satisfied. 

Second, for the security condition, we need to prove that the submatrices 
of any less than k rows of Bq and B\ have the same columns, and only in such 
a case, all the column permutations of the two submatrices will generate the 
same collection, that is, the security condition is satisfied. Denote Bq (resp. 
B\) as the submatrix generated by restricting to arbitrary t rows of Bq (resp. 
Hi), where t < k. Denote Bq (resp. B\) as the submatrix generated by con- 
catenating Bq (resp. B\) and arbitrary k — t rows chosen from the remaining 
rows of Bq (resp. Bi) (other than the rows in Bq and B\). As discussed above, 
we have Bq = Iq U R. B f = I^UR, where Iq (resp. if) is the matrix that con- 
tains all the even (resp. odd) columns of length k. Note that Iq and 7-f are the 
basis matrices of a (k, /c)-VC scheme proposed in References [16, 3]. We have 
the result that the submatrices generated by restricting to any t rows of Bq 
and Bi have the same columns. Hence, the submatrices generated by restrict- 
ing to any t rows of B 0 and B i have the same columns, that is, the security 
condition is satisfied. ■ 

Besides the above schemes, Liu et al. [15] proposed a step construction to 
construct XOR-based visual cryptography for general access structure by ap- 
plying (2, 2)-VCS recursively, where a participant may receive multiple share 
images. Readers can refer to [15] for more detail. An approach to construct 
extended XOR.-based visual cryptography was proposed in Reference [14]. 


6.4 Visual Cryptography Scheme with Reversing 

First we introduce the following notations that will be used throughout the 
section. Let A\\B denote the concatenation of two matrices A and B of the 
same number of rows. Let |X| be the number of elements in set X. The symbol 
’’©’’denotes an XOR operation. Let GRAY(P) be the gray level of a pixel P 
and defined as GRAY(P) = \ black pixel\/m. 

6.4.1 ( k , n) VC Scheme Using Cyclic-Shift Operation 

Let the shadow image s = [.s,;p ; ] , and the element s l3 ^- is the secret pixel s.y in 
a [W x H)- pixel secret image replaced by m subpixels (siji, Sij 2 , ■ ■ ■ 
where i € [1,W], j € [1,77], and k £ [l,m]. The cyclic-shift operation is 
TQsjjfc]) = [7(syfe)], where y(-) is a 1-bit cyclical right shift function, i.e. , 

1, , Sijm) — (^ijm, $ij 1, , ^ijm— l) 

A matrix operation T(-) cyclically shifts right one subpixel in every m 
subpixels (for a secret pixel) in the shadow image. 

When the difference of whiteness ”h — V ’ is odd, we can design an ideal 
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contrast VC scheme even when the underlying VC scheme with reversing is 
nonperfect black. At this time the decoding needs an XOR operation. 

Yang et al.’s scheme [25] is described in a pseudo-code style below in terms 
of its construction procedure and the revealing procedure. 

Yang et al.’s algorithm for a (k,n)-XC scheme 

Distribution phase. 

Step 1: Given a secret image, the dealer performs a (k, n) nonperfect 
black VC scheme(iV PBVCS) to generate n shadows, .s| , • • • , s* for the 
first run. 

Step 2: The dealer generates the shadows s” = T(s^ 1 ) for the rth run, 
r = 2, • • • ,m. Note that the shadow should be labeled as to which run it 
is, for easy management by the participant. 

Step 3: The dealer distributes to shadows s],--- , s™ to Participant j, 
j = I,-" > fi- 

St ep 4: Finally, every participant holds to shadows. 

Reconstruction phase. 

Step 1: To recover the secret within in runs, at least k participants, 
Participants ji, • • • , jk , offer their ( k x R) shadows s*- 1 , • • • , s* fc , i = 1, • • • R, 
for reconstruction. 

Step 2: Stack the shadows sj 1; ■ ■ ■ , s] k to reconstruct the image T r in the 
rth run. 

T r = Sji + Sj 2 + • • • + s] k , r = 1, • • • , to 

Step 3: Finish in runs by using an XOR operation to reconstruct U' = 
Ti © • • • © T m . 

Step 4: If ”m — ft.” is even (i.e., ”m — Z” is odd) then the reconstructed 
image is U' ; otherwise, the reconstructed image is U' . 


Theorem 9 [25] The whiteness percentages of the white and black secret pix- 
els for Yang et al. ’s algorithm are Pw — 100% and Pw = 0%, respectively, 
after finishing m runs. 

Proof There are ”m — ft” B ”ft” W (respectively ”m — Z” B ”Z” W) subpixels 
for the white (respectively black) secret pixel. When shifting right one bit 
m times, there are in — ft (respectively to — l ) black subpixels for the white 
(respectively black) secret pixels in U r . Suppose ”to — ft” is even (respectively 
odd); an XOR operation will result in all white subpixels for the white pixels 
in IF (respectively IF). Thus, the Pw of the white secret pixel is 100%. On the 
other hand, even (respectively odd) ”m — ft” means odd (respectively even) 
”?n — ?” since ’ft — V is odd. It is evident that an XOR operation will result in 
all black subpixels for the black pixels in IF (respectively IF), i.e., the Pw of 
the black secret pixel is 0%. ■ 

An example (2, 4) — N PBVCS is given below as a demonstration for Yang 
et al.’s algorithm. 
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Example 4 Suppose in (2,4 )-VCS with basis matrices Bq and B\. 


'1000' 


Tooo' 

1000 

,£i = 

0100 

1000 

0010 

1000 


0001 


The distribution phase is shown in Table 6.1 and the reconstruction phase is 
shown in Table 6.2 and Table 6.3. 

Distribution phase: 

TABLE 6.1 


Distribution phase of (2,4)-VCS using Yang et al.’s [25] algorithm. 


Pixel 

First run 

Second run 

Third run 

Fourth Run 

White 

sf = ( 1000 ) 

s( = ( 0100 ) 

sf = ( 0010 ) 

sf = ( 0001 ) 

White 

si = ( 1000 ) 

sf = ( 0100 ) 

sf = ( 0010 ) 

sf = ( 0001 ) 

White 

S 3 = ( 1000 ) 

S 3 = ( 0100 ) 

si = ( 0010 ) 

sf = (0001) 

White 

s\ = ( 1000 ) 

si = ( 0100 ) 

sf = ( 0010 ) 

sf = (0001) 

Black 

sf = ( 1000 ) 

sf = ( 0100 ) 

sf = (0010) 

sf = ( 0001 ) 

Black 

4 = ( 0100 ) 

si = ( 0010 ) 

sf = ( 0001 ) 

sf = ( 1000 ) 

Black 

si = ( 0010 ) 

sf = ( 0001 ) 

S 3 = ( 1000 ) 

sf = (0100) 

Black 

sf = ( 0001 ) 

si = ( 1000 ) 

si = ( 0100 ) 

sf = ( 0010 ) 


Reconstruction phase 


TABLE 6.2 

Reconstruction of participant 1 and 2 using Yang et al.’s [25] algorithm. 


Pixel 

First run 

T\ = s\ + 

Second run 
T 2 = s\ + sf 

Third run 

T 3 = sf + si 

Fourth run 
T 4 = sf + sf 

U' 

White 

Black 

( 1000 ) 

( 1100 ) 

( 0100 ) 

( 0110 ) 

( 0010 ) 

( 0011 ) 

( 0001 ) 

( 1001 ) 

( 0000 ) 

( 1111 ) 

TABLE 6.3 





Reconstruction of participant 3 and 4 using Yang et al.’s [25] algorithm. 

Pixel 

First run 

Ti = sf + sf 

Second run 
T 2 = sf + sf 

Third run 

T 3 = sf + sf 

Fourth run 
T 4 = sf + sf 

U' 

White 

Black 

(TOGO) 

( 0011 ) 

(olho) 

( 1001 ) 

( 0010 ) 

( 1100 ) 

( 00 UT) 

( 0110 ) 

( 0000 ) 

( 1111 ) 


We can see that the white pixel is reconstructed as four white subpixels 
and the black pixel is reconstructed as four black subpixels. 
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6.4.2 A Scheme for General Access Structure 

Let P = {1,2,- •• , n} be a set of participants, 2 P represents the set of all 
subsets of P. Let T qua i C 2 P and T f or b C 2 P , where T qua i n T f or b = </>. The 
members of rq Uai (resp. V f or b) is called qualified sets (resp. forbidden sets). 
The T = {T qual ,T f or b) is called the access structure. Define To = {A £ T qua i : 
A' T qua i for all A ' C A} be all the minimal qualified sets [1]. 

Suppose To = {Tqj, • • • , Tq, }, by employing the optimal (k,k)- scheme 
[16], the basis matrices Lo and L\ are constructed as follows: 

Let k p = |T Qp |, and Tq p = {pi, ■ ■ ■ ,p fcp }, for 1 < p < t. We will construct 
a n x 2 kp ~ 1 matrix E p , i £ {0, 1} according to the following steps: the Pi row of 
Ep is the i-th row of the basis matrix Bq of the ( k p , fc p )-scheme. The elements 
of other rows of Ep are all l’s. 

Then Lo = E®. The construction of Ep is similar to Ep except we replace 
the pi row of Ep from the basis matrix B\ of the ( k p , /c p )-scheme instead of 
B 0 - Then Li = E\\\ - ■ ■ \\E]. 

Lemma 10 [10] The Lq and L\ are a pair of basis matrices of a perfect black 
VC scheme for To such that the expansion rate is m = + • • • + 

and GRAY {white) = 1 — 1 /m. 

We now construct an n x 2 fep ~ 1 matrix F p , which has the property that 
the elements in pi row of F p are all 0’s and the other rows of F p are all l’s, 
here 1 < p < t. Then an auxiliary basis matrix Aq = fil • • • | Fi. 
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Hu and Tzeng [10] algorithm for minimal access structure 
Input: 

1. To on a set p of n participants. 

2. Let Cp and C [ be the collection of basis Boolean matrices E p and 
Ep, where 1 < p < |r 0 |. 

3. Let Cp be the collection of matrix F p . 

Output: 

The reconstructed secret image U. 

Distribution phase: 

The dealer encodes each transparency ti as |T 0 | subtransparecies t l p and 
each subblock consists of one secret image. For 1 < p < |To|, each white 
(resp. black) pixel on subblock is encoded using n x 2 fcp_1 matrices E p 
(resp. Ep). To share a white (resp. black) pixel, the dealer performs the 
following steps: 

Step 1: Randomly choose a matrix S° in (resp. Si in C[), and a 
matrix = [a,;j] in C p . 

Step 2: For each participant i, put a white (resp. black) pixel on the 
subblock ti iP if Sij = 0 (resp. Sij = 1). 

Step 3: For each participant i, put a white (resp. black) pixel on the 
subblock A i p if a^j = 0 (resp. oqj = 1). 

Reconstruction phase: 

Let Q p = {ii,--- ,ik p } be the minimal qualified set in To, participants 
in Q p reconstruct the secret image by: 

Step 1: XORing all the shares tj and stacking all the shares Aj for j = 

1, • • • ,k p and obtain T and A: T = t\ © • • • ® tk p , A = A x + A 2 H h A kp 

respectively. 

Step 2: Computing U = (T + A) ® A. 


Lemma 11 [10] The (k,k)-VC scheme [16] is an ideal contrast ( k,k)-VC 
scheme with reversing. 

Proof k participants perform XOR operations on the k transparencies by 
computing ti ® < 2 ® ■ ■ ■ ®t k - It is easy to see that the white pixels are all white 
since So has an even number of l’s; whereas the black pixels are all black since 
Si has an odd number of l’s. ■ 

Theorem 10 [10] Let T = (P,Q,F) be an access structure on a set p of n 
participants. Then the basis matrices Bo, B i, and Ao constitute a compatible 
ideal contrast VC scheme with reversing in two runs. 

Proof It is obvious that the VC scheme is security. The basis matrix Aq also 
reveals absolutely no information about the secret image since no secret is 
encoded into the shares Aj for j = 1, • • • , k p . 
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Let L 0 = || • • • || Et, L\ = E\\\ - • • \\Ef and H 0 = Fl|| • • • ||F t be the basis 

matrices for a VC scheme with reversing, constructed using the previously 
described technique. Without loss of generality, let r 0 = {Qo,--- ,Qt} and 
X = Qi, X be a subset of qualified participants. Since the secret image is 
reconstructed by computing (T + A) ® A, we will prove that the general access 
structure has an ideal contrast, i.e., H((Ei + Fi) © Fi) = 0, H({E\ + F\) © 
Fi) = and H((E% + Fi) © Fj) for i = 2, - - ■ , |L| and b = 0,1. It 

results that H{(E% + Fi) © Fi) = F((F? + 0) © 0) = H(E^ © 0) = H(E%) = 
0 by Lemma 11, and H((E{ + F x ) © Fi) = H((E} + 0) © 0) = H(E{ © 0) = 
H{E{) = by Lemma 11, whereas, H{{E* + F») © Fj) = H((E \ + 1) © 

1) © 1 = w(l © 1) = 0 for i = 2, • • • , |Lo| and b = 0,1. ■ 

We give the following example to illustrate the construction method above. 

Example 5 Let p — {1,2, 3,4} and r 0 = {{1, 2}, {1, 3}, {2, 3}}. Then the 
basis matrices Lq, Li, and A are constructed as follows according to the method 
above. Bq and B\ are basis matrices of a (2,2) — VC scheme. 


F° = 

1 

o o 

T— 1 T— 1 

! 

,E° 2 = 

'll 

10 

,£° = 

'10' 

11 

,El = 

To' 

01 

,E\ = 

'll' 

10 

.^3 = 

To' 

11 


10 


10 


10 


11 


01 


01 



'101110' 


Toilio" 

Lo — 

101011 

111010 

M = 

011011 

110101 


Fi = 

1 

o o 

0 o 

1 

,f 2 = 

'll 

00 

,F 3 = 

' 00 ' 

11 

> T 0 — 

'001100' 

000011 


11 


00 


00 


110000 


The distribution phase is shown in Table 6.4 and the reconstruction phase 
is shown in Tables 6.5, 6.6, and 6.7. 

Distribution phase 


TABLE 6.4 

Distribution phase of the visual cryptography with minimal access 
structure T 0 = {{1,2},{1,3},{2,3}} using Hu and Tzeng [10] algorithm. 


Pixel 

First run 

Second run 

Black 

h = (101110) 

Hi = (001100) 

Black 

t 2 = (011011) 

A 2 = (000011) 

Black 

t 3 = (110101) 

A 3 = (110000) 

White 

h = (101110) 

A i = (001100) 

White 

t 2 = (101011) 

A 2 = (000011) 

White 

t 3 = (111010) 

A 3 = (110000) 
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Reconstruction phase 

TABLE 6.5 


Reconstruction of participant 1 and 2 using Hu and Tzeng [ 10 ] algorithm. 


Pixel 

First run 

T = ti © t 2 

Second run 

A = A± + A2 

U = (T + A) © A 

Black 

(110101) 

(001111) 

(110000) 

White 

(000101) 

(001111) 

(000000) 


TABLE 6.6 


Reconstruction of participant 1 and 3 using Hu and Tzeng [ 10 ] algorithm. 


Pixel 

First run 

T = t\ © £3 

Second run 

A = Ai + A3 

u = (T + A) © A 

Black 

White 

(011011) 

(010100) 

(111100) 

(111100) 

(000011) 

(000000) 


TABLE 6.7 


Reconstruction of participant 2 and 3 using Hu and Tzeng [ 10 ] algorithm. 


Pixel 

First run 

T = t 2 © £3 

Second run 

A = A 2 + A3 

u = (T + A) © A 

Black 

(101110) 

(110011) 

(001100) 

White 

(010001) 

(110011) 

(000000) 


6.5 Secret Sharing Scheme Using Boolean Operation 

This section gives an introduction to some methods using an XOR Boolean 
operation directly without using basis matrices to construct secret sharing 
schemes. The algorithms of three schemes: the probabilistic ( 2 ,n) secret shar- 
ing scheme, (n, n ) secret sharing scheme, and ( k , n) secret sharing scheme will 
be described. 

Consider a secret image A with size Nr x Nq- Each pixel of A can take 
any one of c different colors or gray levels. Image A is represented by an 
integer matrix A. A — [ a.ij] NRXNc , where « = 1,2,--- , Nr, j = 1, 2, • • • , N c , 
and a,ij £ { 0 , 1 , • • • , c — 1 }. We have c = 2 for a binary image and c = 256 
for grayscale image with one byte per pixel. In a color image with one byte 
per pixel, the pixel value can be an index to a color table, thus, c = 256 . 
In a color image using an RGB model, each pixel has three integers: R(red), 
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G(green), and B(blue). If each R, G, or B takes a value between 0 and 255, 
we have c = 256 3 . This integer matrix is also called A and will be treated 
as equivalent to the secret image A itself. The symbol denotes an AND 
operation in the following construction. 

6.5.1 ( 2 , n) Scheme 

To solve the pixel expansion problem with VSS schemes, Ito et al. [11], Yang 
[24] and Cimato et al. [6] proposed probabilistic VSS models. The frequency 
of white pixels in a white (or black) area is used to display the contrast of the 
recovered image. In reconstructing the secret image, the ”OR”-ed operation of 
pixels of the shadows is the same as the stacking operation of subpixels in the 
nonprobabilistic VSS schemes. They defined po (resp. pi) as the appearance 
probability of a white pixel in a white (resp. black) area of the recovered 
image. For a fixed threshold probability 0 < pth < 1 and relative contrast 
a > 0, if po > pth and pi < pth ~ ct, the frequency of white pixels in a white 
area of the recovered image should be higher than that in a black area. 

Wang et al. [23] proposed a probabilistic (2, n) secret sharing scheme for 
binary images. Boolean XOR and AND operations are employed, and n + 1 
distinct random matrices are generated as intermediate results. The scheme 
is described in a pseudo-code style below in terms of its input, output, the 
construction procedure, and the revealing procedure. 

Wang et al.’s [23] algorithm for ( 2,n ) scheme 

Input: an integer n with n > 2, and the secret image A. 

Output: distinct matrices A\ ■ ■ ■ ,A n , called shadow images. 

Construction: 

Step 1: Generate n + 1 random matrices B i, • • • , B n+ 1 . 

Step 2: Compute n intermediate matrices Ci,--- ,C n with Ci = BiSzA 
for i = 1, ■ ■ ■ ,n. 

Step 3: Compute n shadow images Ai, ■ ■ ■ , A n with Aj = B n+ \ ® Ci for 
i = 1, • • • , n. 

Revealing: A' = A t ® Aj where i,j £ {1, 2, • • • , n} and i ^ j. 


For integer scalar inputs between 0 and c— 1, each operand is represented in 
binary and the operation is carried out bit-by-bit. For example, when a = 125 
and b = 18, the XOR between these two integers is 

a®b = (125)ioffi(18)io = (0mil01) 2 ffi(00010010)2 = (01101111) 2 = (lll)io 

For matrix inputs, the XOR operation of two Nh x Nc matrices is defined 
pixel-wise. That is, 

A ® B = [a i:j ® bij], where i = 1,2,--- , N R ,j = 1, 2, • • • ,N C . 


© 2012 by Taylor & Francis Group, LLC 




176 Visual Cryptography and Secret Image Sharing 

The AND operation for integer scalar operands and matrix operands can be 
defined similarly. 

In all computations, every pixel is handled individually, separated from 
other pixels. Therefore, to make the context clear, we denote pixel Aj(s, t) 
simply as A,. With the above construction procedure, for a ”0” pixel in A and 
any i, we have C\ = 0 = 0 and A t = B n+ \ © C, = B n+ 1 , thus 

A' = Ai © Aj = B n+ 1 © B n+ 1 = 0. 

For a ”1” pixel in A, C,; = B^l = Bi and A; = B n+ 1 © B in thus 

A' = Ai © Aj = B n+ 1 © B n+ 1 © Bi © Bj = B, © Bj 

which could be 0 or 1. In other words, between the original image A and 
a reconstructed image A', the ”0” bits are kept the same and the ”1” bits 
may or may not changed. With any single shadow image, no information of 
A is revealed because of the random nature of the matrices B' s. It is easy 
to verify that the n matrices Ai, A 2 , ■ ■ ■ , A n are n distinct random matrices 
from construction method above, each Aj (i = 1, • • • ,n) does not contain any 
information of the original matrix A. 

Associated Shamir’s secret sharing scheme and a gradual search algorithm 
for a single bitmap block truncation coding with the above (2, n) scheme, the 
secret sharing scheme for color images was proposed in Reference [3]. Com- 
bined the above (2, n) scheme with voting strategy, the probabilistic visual se- 
cret sharing scheme for grayscale images was provided in Reference [4] . Based 
on the above proposed (2, n) scheme, the matrices B\, B 2 , ■ ■ ■ , B n are chosen 
according to Yang’s into ’’probabilistic VC scheme and the (2, n ) probabilistic 
scheme with improved contrast was given in Reference [19]. 

6.5.2 (n, n) Scheme 

The construction steps are given in the context of grayscale images. It is triv- 
ially applicable to binary images and can be easily extended to color images. 

Wang et al.’s [23] algorithm for ( n,n ) scheme 

Input: an integer n with n > 2, and the secret image A. 

Output: n distinct matrices Ai, • • • , A„, called shadow images. 

Construction: 

Step 1: Generate n — 1 random matrices B 1 , • • • , B n _\. 

Step 2: Compute the shadow images as below: 

A\ = Bi , A 2 = Bi © B 2 , , A„_ 1 = B n _ 2 © B n _ 1 , 

An = B n _ 1 © A. 

Revealing: A! = A\ © A 2 © • • • © A„. 


Theorem 11 [23] A\ © A 2 © • • • © A„ = A. 
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Proof Because the ” ®” operation is associative and Bi © Bi is a zero matrix 
for any i, we have 

A' = B x © (Bi © B 2 ) 0 • • • 0 (S„_ 2 © -Bn-i) © (S„- i © A) 

= (B-i © Bi) © • • • © (£ n _i © B n _{) © A 
= A. 


Theorem 12 [23] An(BAi 2 ®- ■ -(BAu- A for any set of integers {i\, ■ ■ ■ ,ik} 
when k < n. 

Proof We consider two cases. Case 1 is for n G {i 1? ■ • • , i/.} and Case 2 is for 
n $. {*i, • • • jifc}. 

Case 1: n G {*!,■•• ,ik}- In this case, A n © (®j- a Aj) = A © © 

(®j— s Aj) where ©* =s means A s © • • • © A t with s, ■ ■ ■ ,t being the indices in 
{*i, • • • , ik} besides n. Since there are an odd number of n — 2 term random 
matrices involved, at least one of them cannot be absorbed into a zero matrix, 
thus A ix © A i2 © • • • © A ik must be random, thus not equal to A. 

Case 2: n ^ {i\, • • • , ik}. Since no matrix A involved in A i± ®A i2 ©• • • ®A ik 
to begin with, A ix © A i2 © • • • © A ik is constructed from the n — 1 term random 
matrices only and it must be random. ■ 

Next, we analyze the steps of Wang et al.’s [23] ( n,n ) algorithm in the 
context of the grayscale image below. It is trivially applicable to a binary 
image and can be easily extended to a color image. Now we give an example 
to demonstrate the computation steps in the construction/revealing process 
using the above algorithm. 

Example 6 Let n = 3 and the secret image A be a single pixel. 


Input: A = (240) io = (1111 0000) 2 

Construction: 

Step 1: 

Si = (125)io = (0111 1101) 2 , 

B 2 = (10)io = (0001 0010) 2 
Step 2: 

Ai = Bi — (125)io = (0111 1101) 2 , 

A 2 = B 1 ©S 2 = (0110 1111) 2 , 

A 3 = B 2 ®A=( 1110 0010) 2 

Revealing: A! = A\ © A 2 © A 3 = (1111 0000) 2 = (240) io- 


From the above algorithm, it is known that the proposed (n, n) scheme 
reconstructs the secret image exactly and when fewer than n shadows are 
used, the original secret image A will not be revealed. Moreover, only simple 
Boolean XOR operations are used and the size of each shadow image is the 
same as the original image, thus no pixel expansion. The above (n, n) secret 
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sharing scheme was applied to deal with gray scale and color secret images 
respectively in Reference [22] . 


6.5.3 ( k , n) Scheme 


Based on above Wang et al.’s [23] (n,n) secret sharing scheme [23], Chao 
and Lin [5] have attempted to construct a ( k , n) secret sharing scheme. To 
design a threshold ( k,n ) scheme, one may first directly utilize Wang et al.’s 

[23] ( m,m ) scheme for some carefully chosen parameter m = n The 


(k,n,m) shadows-assignment matrix has n rows and m columns. Its n rows 
represent n persons; and its m columns represent the m (distinct) temporary 
shadows produced by the above (to, to) scheme. The element of H is either 
0 or 1. The i-tli person (row) has a copy of the j-th shadow image (column) 
if and only if H l:l . Each column of H have exactly k — 1 zeros and n — k + 1 
ones. 

Now we will introduce Chao et al.’s ( k , n)-VC scheme based on the (k, n, to) 
shadows assignment matrix H. 
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Input: the secret image A 
Output: the final shadow S, 

Construction: 

Step 1: Generate a random image B\ with the same size as A. 

Step 2: Generate another image B 2 using B 2 = B\ ® A. 

Step 3: Construct a n x m. shadows-assignment matrix H , each column 

of H have exactly k — 1 zeros and n — k + 1 ones, so m = 

Step 4: Partition Bi and B 2 into m nonoverlapping blocks 
Cii, C21, • • • , C m i and C\ 2l C 22 , • • • , C m2 . 

Step 5: Let C* = Cu © C 2 i ® • • • © C ml . Compute 3 = C i2 © C*. 

Step 6: Construct m temporary shadows C\ , C 2 , • • ■ , C m , where the up- 
per half of each Ci is the block Cu and the lower half of each Ci is the 
block C, 3 . 

Step 7: Assign the duplicated copies of the m temporary shadows 
C\ , C 2 , • • • , C m to the n persons according to the shadows-assignment ma- 
trix H . For each participant i, the final shadow Si is exactly the union of 
those copies assigned to him. 

Revealing: 

Step 1: k participants using their shares S' n , ,• • • ,Si k to reconstruct the 
secret image. Referring to H , all m temporary shadows C\, C 2 , ■ ■ ■ , C m can 
be extracted from these k final shadows. 

Step 2: The upper half of each Ci is the block Cu and the lower 
half of each Ci is the block C;, 3 . So we get all Cn,C 2 i,-- ■ ,C m 1 and 

C13, C23, • • • , C m 3 ■ 

Step 3: Compute C* = C\\ © C 2 i © • • • © C ml , then C i2 = C i3 © C*. 
Step 4: Recombination Cu, C 2 i, • • • , C m 1 and Ci 2 , C 22 , • • • , C m2 into B 1 
and B- 2 . 

Step 5: Reveal the secret image A ' by A! = B\ © B 2 . 


n 

k - 1 


Let the size of secret image A be Nf> x Nc ■ Since the size of every temporary 
shadow Cj(l < i < m) is 2 x {Nr x Nc)/m, the size of every final shadow 


5j(l < * < n) is 


2x(N r xN c ) 


n — 1 
k- 1 


= 2(AfRXjVc) ( n - fc+ i) . Notice that 


each final shadow S',; ( 1 < i < n) contains 


n — 1 
k- 1 


temporary shadows. After 


we divide by the size of secret image A, we obtain the pixel expansion rate 
per = 2 x ”~^ +1 < 2. Each shadow will be at most two times larger than 
secret image A. 

Next, we will give an example to analyze the steps of Chao and Lin [5] 
( k,n ) algorithm scheme. 


Example 7 Let k = 3,n = 4, and a grayscale secret image A = 
235 45 239 

188 103 234 ' 
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Input: the secret image A = 


'235 45 

188 103 

Output: the final shadows Si, S2, S3, S 4 

Construction: 


Step 1: Generate random image B 1 = 


Step 2: Generate B - 2 = B\ 

130 35 63 ' 

88 61 232 

Step 3: to = 


A = 


239' 






234 






'105 

14 208] 




228 

90 

2 J 




i 14 

208' 


'235 

45 

239' 

S 90 

2 

® 

188 

103 

234 


n 

k — 1 


= ( 2 ) • Construct a 4 x 6 shadows-assignment 


matrix H, each column of H have exactly 2 zeros and 2 ones, so 


/ 0 0 0 1 1 l\ 

0 110 0 1 

10 10 10 

\1 1 0 1 0 0 / 


Step 4: Partition B\ into 6 nonoverlapping blocks Cn = 105, C21 = 
14, C31 = 208, C41 = 228, C51 = 90,C 6 i = 2, Partition into 6 nonoverlap- 
ping blocks C-,2 = 130, C 22 = 35, C 32 = 63, C 42 = 88, C 52 = 61, C 62 = 232. 

Step 5: C* = Cn © C 2 i © • • ■ © C 6 i = 105 © 14 © 208 © 228 © 90 © 2 = 11. 
Compute Ci 3 = C12 © C* = 130 © 11 = 137, similarly C23 = 40, C33 = 
52, C43 = 83, C 53 = 54, C 63 = 227. 


Step 6: Construct 6 temporary shadows Ci = 


105 

137 


,C 2 = 


,C 3 = 


208 

52 


,C 4 = 


228 

83 


,C S = 


,C 6 = 


2 

227 


,, where the upper half of each 


Ci is the block Cn and the lower half is the block Ci 3. 

Step 7: According to the shadows-assignment matrix H, assign 
O4, O5, 06 > Ol, O2, O3, 06 — > 02 , Oi,03, O5 — > 03, Oi, 0-2, 0 4 — > 04. 

Revealing: 

Step 1: Suppose 3 participants using their shares Si . S 2 , S 3 to reconstruct 
the secret image. Referring to H , all 6 temporary shadows Ci = , C 2 = 


14 

40 


,C 3 


208 

52 


,C 4 


228 

83 


,C 5 



2 

227 


can be extracted 


from Si, S2, S3. 

Step 2: The upper half of each C \ is the block C-n and the lower half of 
each Ci is the block Cl3. So we get all Cn = 105, C21 = 14, C21 = 14, C31 = 
208, C 4i = 228, C51 = 90, C 6 i = 2 and C 13 = 137, C 23 = 40, C 33 = 52, C 43 = 
83, C53 = 54, C 63 = 227. 

Step 3: Compute C* = C 11 ffiC 2 iffi- • -©C 6 i = 105©14©208©228ffi90©2 = 
11, then C12 = C13 © C* = 137 © 11 = 130. Similarly, C 22 = 35, C 32 = 
63, C 42 = 88, C 52 = 61, C 6 2 = 232. 
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Step 4: Bi = 


Cu 

C 2 1 

C 31 


'105 

14 

208' 

c 4 1 

C 51 

Cqi_ 


228 

90 

2 


c 12 

C 22 

C32 


'130 

35 

63' 

c 42 

C52 

c 62 _ 


88 

61 

232 


Step 5: Reveal the secret image 
A' = B 1 © B 2 = 


and B -2 = 


'105 

14 

208' 


'130 

35 

63' 


'235 

45 

239' 

228 

90 

2 

© 

88 

61 

232 

— 

188 

103 

234 


6.6 Conclusion 

XOR-based visual cryptography schemes use XOR operation to decrypt the 
secret. These schemes have higher contrast compared with OR-based visual 
cryptography. This chapter introduced three types of different XOR-based 
visual cryptography schemes. The three type schemes have their virtues re- 
spectively. We also notice there is XOR-based audio cryptography, which uses 
music to embed message and relies on the human auditory system to decrypt 
secret messages. It is a very interesting topic, however we do not cover audio 
cryptography schemes because the topic in this chapter is limited to image, 
and readers can see more details in Reference [8]. 
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7.1 Introduction 

A random grid was defined by Kafri and Keren in 1987 [7] as a transparency 
comprising a two-dimensional array of pixels. Each pixel is either fully trans- 
parent or simply opaque and the choice between the alternatives is made by 
a coin-flip procedure. Thus, there is no correlation between the values of dif- 
ferent pixels in the array. 

We could encrypt binary pictures or shapes into two random grids such 
that only the areas containing information in the two grids are intercorrelated, 


185 
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while the others are purely random. When the two grids are superimposed 
together, the correlated areas will be resolved from the random background 
due to the difference in light transmission so that the secret picture or shape 
can be seen visually. Just like conventional schemes in visual cryptography, the 
decoding process is done by the human visual system where no computation 
is needed; however, no extra pixel expansion is required using random grids. 

Observing the interesting features of random grids in image encryption, 
which were discussed right before Naor and Shamir’s visual cryptographic 
scheme (VCS) [9], Shyu [12, 13] generalized the random grids-based ap- 
proaches into visual cryptograms of random grids (VCRG) for achieving visual 
secret sharing recently. The most appealing benifits using random grids lie in 
that the pixel expansion needed is merely one and no basis matrix is needed. 
With the same contrast in the reconstructed results, the optimal pixel expna- 
sion in (n, n)-VCS is 2 n_1 ; while that in (n, n)-VCRG is still 1. 

We study the random grids-based schemes, analyze the performances, and 
demonstrate their feasibilities in this chapter. The rest of the chapter is or- 
ganized as follows. The fundamental characteristics of random grids are dis- 
cussed in Section 7.2. Section 7.3 discusses how to apply visual cryptograms 
of random grids in visual cryptography where the formal definition of VCRG 
is given, and the designs, analyses, and implementations of (2, 2)-VCRGs and 
(n, tt)-VCRGs for binary, gray-level and color images are examined. Section 
7.4 exhibits some concluding remarks. 


7.2 Random Grids 

7.2.1 Random Pixel, Random Grid, and Average Light 
Transmission 

We refer to a binary pixel r as a random pixel if the choice for r to be trans- 
parent or opaque in R is totally random; or equivalently, the probability for 
r to be transparent is equal to that for r to be opaque, 

= 0) = = 1) = i, (7.1) 

where 0 (1) denotes a transparent (opaque) pixel. Since a transparent pixel lets 
through the light while an opaque one stops it, the average light transmission 
of random pixel r is | , denoted as 

= ( 7 - 2 ) 

Definition 1 R is a binary random grid if each pixel r in R is a binary 
random pixel. 
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Regarding a random grid R , the number of transparent pixels is probabilis- 
tically the same as that of opaque ones so that the average light transmission 
of R is also denoted as 




(7.3) 


7.2.2 Superimposition of Random Grids 

Let ® denote the generalized ”or” operation, which describes the relation of 
the superimposition of two random pixels or grids pixel by pixel. It is obvious 
that r (g> r (R ® R) is entirely the same as r (R), that is 

^ (r ® r) = ^ or £T(R ® R) = ^ (7.4) 


for each pixel r in R. 

Let R\ and i ?2 be two independent random grids with the same size. When 
R\ and R 2 are superimposed pixel by pixel, each pixel (either transparent or 
opaque) in Ri has an equal possibility to be stacked by a transparent pixel 
or an opaque pixel in i? 2 -We call r\ = Ri[i,j] the corresponding pixel of 
7*2 = Ri[i' ,j'] if and only if i = i' and j = f (the positions of ri at R± and r 2 
at i ?2 are the same). It is easy to see that the order of the two random grids 
does not affect the superimposed result, i.e. , 


R 1 <8>R 2 = R 2 ®R 1 . (7.5) 

Indeed, ® is a commutative operation. 


TABLE 7.1 

Results of the superimposition of two random 
pixels. 


n 

ri 

ri ® r 2 

0 

0 

0 

0 

1 

1 

1 

0 

1 

1 

1 

1 


Table 7.1 shows the superimposed results of the corresponding random 
pixels r\ and r' 2 . There is only one outcome among the four possible combi- 
nations of r\ ® V 2 showing transparency. Since the four possible combinations 
occur with an equal probability, the probability for n ® r 2 to be transparent 
is 1. That is, the average light transmission of the superimposition of Ri and 
Ri (ri and r 2 ) is 

We summarize the aforementioned properties in Lemma 1. 
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Lemma 1 If Ri and R 2 are two independent random grids with 22 (Ri) = 

&{Ri) = 1 / 2 , 

(1) 22{R 1 ® R 2 ) = 22{R 2 ® R ± ) = 1/4; 

(2) 22{R 1 ®R 1 ) = 1/2. 

We define .R to be the inverse random grid of R if and only if 

r' = f 

for each r' in R where r is the corresponding pixel of r' in R and f denotes 
the inverse of r. It is easy to see that r ® r = 1 and R<S> R = 1 (1 denotes a 
grid in which all pixels are opaque), that is 

/(r ® f) = 0 and IY(R® R) =0 (7.6) 

For each pixel r' in R , since 22 = 0) = 22 >/2'{f = 0) = S 6 ^/'{r = 

1) = 1. we obtain 

*('') = !, and 22(R) = ^ (7.7) 

In general, the relationship of the average light transmissions of R £ R is 
given in Lemma 2. 

Lemma 2 If R is a random grid with 22 (R) = A, 22 (R) = 1 — A. 

Proof From 22(R) = A, we know that for any pixel r £ RI2t<?tf(r = 0) = A 
and 2? ie/f(r = 1) = 1 — A. Let r' € R be the corresponding pixel of r. Thus, 
22 u><f(r' = 0) = 2? u><f(r = 1) = 1 — A and 22 u><f(r' = 1) = 22 u><f(r = 0) = A. 
We have 22 (R) = 1 — A. ■ 

Consider two independent random grids X and Y . There is another im- 
portant property called the principle of combination : if we cut a section, say 
A , from X and replace it with section B (with the same size as A) from Y, 
the result, denoted as Z = (X \ A) D B, is another random grid, i.e., 

22(Z) = &(X) = 22 (Y) = i (7.8) 

We shall expose how to use the aforemnetionecl characteristics of random 
grids to accomplish visual secret sharing in the next section. 
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7.3 Visual Cryptograms of Random Grids 

First of all, we give a formal definition to VCRG for binary images in Section 
7.3.1. Section 7.3.2 presents three algorithms for producing (2, 2)-VCRGs for 
binary images. The implementation results of these algorithms are reported 
in Section 7.3.3. Section 7.3.4 evaluates the performances of these algorithms 
in terms of light contrast. Then, algorithms for producing (n, n)-VCRGs for 
binary images are discussed in Section 7.3.5. Further, those for gray-level 
and color images are examined in Section 7.3.6. Section 7.3.7 reports the 
experimental results of (n,n)-V CRGs. The correctness of these algorithms 
would be proved and the corresponding light contrasts would be analyzed 
accordingly. 

7.3.1 Definition of VCRG 

Consider a set of n random grids S = {i?i, R 2 , ■ ■ • , Rn }, which are encrypted 
to share a a secret image B such that i?i (g> R 2 ® ■■■ ® R n reveals B to our eyes 
while any group of less than n grids obtains no information about B. We call 
S a set of visual cryptograms of random grids with respect to B. 

Let 5(0) (5(1)) denote the area of white (black) pixels in B and 5^ [5(0)] 
(5[5(1)]) denotes the area of pixels in S s corresponding to 5(0) (5(1)) where 
S s = R\®R 2 ®- ■ -®R n - Formally, a set of (n, n) visual cryptograms of random 
grids for a binary image is now defined as follows. 

Definition 2 Given a binary image B, n random grids {Ri, R 2 , ■ ■ ■ , R n } 
comprise a set of visual cryptograms, referred to as ( n,n)-VCRG of B if the 
following conditions hold: 

(1) Rr is a random grid with ^{Rf) = 1/2 for 1 ^ i ^ n; 

(2) &(S s [B( 0)]) = &(S 9 [B( 1)]) where S® = R h <g> R i2 <g> • ■ ■ ® R td which 
is the superimposed result of some set = {Ri 1 ,Ri 2 , . . . , Ri d } of d distinct 
random grids in S, i.e., £> C S, 2 ^ d ^ n — 1 and 1 ^ i\ < ii < ■ ■ ■ < id ^ 
n; and 

(3) S?(S' s [B( 0)]) > ^(S ,<? [5(1)]) where S s = R\ ® R 2 ® • • • <8 R n and S = 
{Rl,R'2, ■ ■ ■ , Rn}- 

Both Conditions 1 and 2 are ’’security” conditions which ensure that each 
individual grid and the superimposed result of any group of less than n random 
grids are merely random grids so that no information of 5 can be obtained. 
Condition 3 is the ’’contrast” condition, which claims that once the light 
transmission of S , ‘ ? [5(0)] is larger than that of 5' s ’[5(l)], our visual perception 
is able to distinguish 5(0) from 5(1) by observing S s due to the difference 
of their light transmissions in S s . 
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Note that this definition is different from that in Naor and Shamir’s model. 
Suppose that C\ and C 2 are the two encoded shares produced by some (2, 
2)-VCS using basis matrices M° and M 1 with respect to binary image B. 
Then the security condition in (2, 2)-VCS is w(M b [ 1]) = (M b [ 2]) for 6 £ 
{0, 1} where M b [i] is the itli row of M b for i £ {1, 2}, while the contrast 
condition becomes w(M 1 [ 1] or M 1 [2]) — (M°[l] or M°[ 2]) > 0. Let ci in C\ 
and C 2 in C 2 be the corresponding pixels of b in B. Let d = Ci ® C 2 where d 
is in D = Ci (g> C 2 . Let 6(0) (6(1)) denote the pixel of 6 = 0(1) and d[6(0)] 
(d[6(l)]) denote such d corresponding to 6(0) (6(1)). Since each 6 = 0 (1) is 
encoded according to M° (M 1 ), the contrast condition in (2, 2)-VCS assures 
u>(d[6(l)])— ru(d[6(0)]) > 1 so that d(l) can be identified from d(0) for all d(0)’s 
and d(l)’s in D. However, VCRG only demands 3?(S{B(0)])—S?(S{B(1))) > 0, 
or equivalently, ^(s[6(0)]) — ^(s[6(l)]) > 0. 

7.3.2 (2, 2)-VCRG Algorithms for Binary Images 

Let random jpixel(0, 1) be a function that returns a binary value 0 or 1 to 
represent a transparent or opaque pixel, respectively, by a coin-flip procedure 
and R±[i,j] denote the complement of Ri[i, j]. Each of the following three al- 
gorithms successfully encodes a secret binary image B into two random grids 
R 1 and R 2 which constitute a set of (2, 2)-VCRG. 

Algorithms 1—3. Sharing a binary image by two random grids 

Input: A w x h binary image B where B[i, j] £ {0, 1} (white or black), 
l^i^w and l^j^h 

Output: Two shares of random grids Ri and R 2 which reveal B when su- 
perimposed where Rk[i, j] G {0, 1} (transparent or opaque), l^i^w, l^j ^ h 
and k £ {1, 2} 

Encryption(B) 

Algorithm 1. 

1. Generate R\ as a random grid, tV(Ri) = 1/2 

// for (each pixel R\[i,j], l^i^w, and l^j^h) do 
// R±[i,j] = randomjpixel( 0, 1) 

2. for (each pixel B[i, j], l^i^ui and l^j^h) do 

2.1 { if (B[i, j] = 0) then R 2 [i,j] = R\[i,j] 

else R 2 [i,j ] = Ri[i,j] 

} 

3. output(l?i, R 2 ) 
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1. Generate Hi as a random grid, 3?(Ri) = 1/2 

2. for (each pixel B[i, j], l^i^ui and do 

2.1 { if (B[i, j } = 0) then R 2 [i,j] = Ri[i,j) 

else R 2 [i,j] = random jpixeKf), 1) 

} 

3. output(f?i, R 2 ) 

Algorithm 3. 

1. Generate Hi as a random grid, 3?(R\) = 1/2 

2. for (each pixel B[i, j], l^i^w and do 

2.1 { if ( B[i , j] = 0) then R 2 [i, j] = randomjpixel(0 , 1) 

else R 2 [i,j] = R\ [i, j] 

} 

3. output(f?i, R 2 ) 

The three algorithms are capsulated into a generic procedure named En- 
cryption so that when Encryption(B) is called, each of Algorithms 1, 2, or 3 
can be applied onto B. Also note that in this paper, 0 (1) denotes a white 
(black) pixel in the secret binary image or a transparent (opaque) pixel in the 
encrypted share interchangeably. 

Table 7.2 summarizes the encoding process of pixel b in secret image B 
into r\ and r 2 by Algorithms 1, 2, and 3 respectively, the result of ri ® r 2 and 
its average light transmission. 

Let B{ 0) (f?(l)) denote the area of all of the transparent (opaque) pixels 
in B, that is, pixel b is in 13(0) (13(1)) if and only if b = 0 [b = 1) where 
B = 13(0) U 13(1) and 13(0) fl 13(1) = 0. We denote the area of pixels in ran- 
dom grid R corresponding to 13(0) (13(1)) by H[!3(0)] (H[!3(l)]), that is, pixel 
r is in 1?[13(0)] (H[!3(l)]) if and only if r’s corresponding pixel b is in 13(0) 
(B( 1)). Surely, R = H[B(0)] U R[B( 1)] and R[B( 0)] D 1?[B(1)] = 0. 


Based upon the above notations, we have the following theorem. 

Theorem 1 Given a binary image B, {l?i, R 2 } produced by Algorithms 1-3, 
respectively, is a set of (2,2)-VCRG of B. 
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TABLE 7.2 

Encoding b into rr and r 2 and results of s = rr 0 r 2 by Algorithms 1, 2, 
and 3. 



b 

Probability 

n 

r 2 

s = n 0 r 2 

&»A.S = 0) (/(s)) 


□ 

1 

2 

□ 

□ 

□ 

1 

Algorithm 1 


1 

2 

■ 

■ 

■ 

2 


■ 

1 

2 

□ 

■ 

■ 

0 



1 

2 

■ 

□ 

■ 



□ 

1 

2 

□ 

□ 

□ 

1 

Algorithm 2 


1 

2 

■ 

■ 

■ 

2 


1 

4 

□ 

□ 

□ 



■ 

1 

4 

□ 

■ 

■ 

1 

4 



1 

4 

■ 

□ 

■ 




1 

4 

■ 

■ 

■ 




1 

4 

□ 

□ 

□ 



□ 

1 

4 

□ 

■ 

■ 

1 

4 

Algorithm 3 


1 

4 

■ 

□ 

■ 




1 

4 

■ 

■ 

■ 




1 

□ 

■ 

■ 

0 


■ 

2 





1 

2 

■ 

□ 

■ 



Proof To prove that R\ and R 2 constitute a set of (2, 2)-VCRG, we should 
validate whether the following two conditions (setting n = 2 in Definition 2) 
hold: 

(1) tV(Ri) = tV(R 2 ) = and 

(2) f(S[B( 0)]) > &(S[B( 1)]) where S = R 1 ®R 2 . 

Let us examine Algorithm 1 first. Let f?i [B(b)] denote the area of 
pixels in Ri that corresponds to B(b) for b = 0 or 1. Note that R\ = 
Ri[B(0)] U f?i[f?(l)] where f?i[B(0)] fl f?i[f?(l)] = 0. Since Step 1 in Al- 
gorithm 1 composes Ri as a random grid with tV(Ri) =1/2, we have 
= ^(i?i[B(0)]) = ^(i?i[B(l)]) = 1/2. When B[i,j] = 0, we have 
R 2 [i,j] = Ri[i,j\- That means ^(R 2 [B( 0)]) = tV(Ri[B(0)]) = 1/2. Moreover, 
when B[i,j] = l,i? 2 [*,j] = R\[i,j}. By Lemma 2, we have tV(R 2 [B( 1)]) = 
tV(Ri[B{l)]) = 1 — lV(Ri[B( 1)]) = 1 — 1/2 = 1/2. Due to the facts that 
R 2 = R 2 [B{ 0)] U R 2 [B( 1)] and &{R 2 [B( 0)]) = &(R 2 [B( 1)]) = 1/2, we have 
tV(R 2 ) = 1/2 by the principle of combination. Therefore both of Ri and R 2 
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are merely random grids and none of them individually leaks any information 
about B. The security condition of Definition 2 is met. 

Consider B{ 0) (the ares of transparent pixels in B). Since R 2 [i,j] = Ri[i,j] 
for each B[i,j ] = 0 (or B[i,j] £ B( 0)), thus 5[S(0)] = i?i[B(0)] 0/2 2 [.B(O)] = 
i?i[B(0)]. Thus &{S[B(0)]) = 1/2. Regarding B{ 1), R 2 [i,j\ = R\\i, j] for each 
B[i,j) = 1 (or B[i,j] € B{ 1)). We have S[B(1)] = Ri[B(l)) 0 R 2 [B( 1)] = 1 
(an area with all opaque pixels), i.e., 3?(S[B(1)]) = 0. Thus ^(S/L^O)]) > 
3?(S[B(\)]). The light contrast condition of Definition 2 is satisfied. There- 
fore, {Ri,R 2 } produced by Algorithm 1 is a set of (2, 2)-VCRG of B and 
(^(S[B(0)]),^(S[B(1)])) = (1/2,0). 

For Algorithm 2, we have 3? (R 2 [B (0)]) = 3?{Ri [R(0)]) = 1/2 and 
R 2 [R(l)] is purely a random grid with 3?(R 2 [B(\)]) = 1/2. Thus, R 2 is a 
random grid with R 2 ) = 1/2. Since R 2 [B(0)] = i?i[B(0)], ^(5[1?(0)]) = 
^(i?i[R(O)]0i? 2 [S(O)]) = ^((Ri[R(0)]) = 1/2; while i?i[R(l)] and R 2 [B{ 1)] 
are two independent random grids so that ^(^[^(l)]) = 3?(Ri[B(l)\ 0 
f? 2 [S(l)]) = ^(Ri[R(l)]) x 3?(R 2 [B(l)}) = 1/4 (by Lemma 1(1)). We ob- 
tain £r(S[B( o)]) > 3r{s[B( i)]). 

For Algorithm 3, ^(R 2 [B(0)]) = 1/2 because i? 2 [.B(0)] is a purely ran- 
dom grid and ^(i? 2 [-B(l)]) = &(R[[B( 1)]) = 1 - &{(Ri[B(l)}) = 1/2. We 
have 3?(R 2 ) = 1/2. Further, due to the fact that l?i[R(0)] and f? 2 [.B(0)] 
are independent, 17{S[B{ 0)]) = £?{Ri[B(f))\ 0 3TR 2 [B(f))]) = ^”(i?i[B(0)]) x 
3T(R 2 [B(f))]) = 1/4; on the other hand, since R 2 [B(1)} = i?i[R(l)], 5[£?(1)] = 
Ri[B(l)} 0 {R 2 [B{ 1)] = 1, i.e. 3T{S[B( 1)] = 0. We have &{S[B( 0)]) > 
P{.S[B{ 1)]). 

Based upon the above statements, we realize that both security and con- 
trast conditions in Definition 2 hold for all of the three algorithms. We con- 
clude that no information of B can be obtained from random grids R\ or 
R 2 individually, while S reveals B in our visual system for all of the three 
algorithms. Theorem 1 is proved. 

The following corollary is an immediate consequence from the statements 
in the proof of Theorem 1. 

Corollary 1 (^(S[£(0)]), ^(S[B(1)})) = (1/2, 0), (1/2, 1/4) or (1/4,0) for 
Algorithms 1-3, respectively where S = R\ 0 R 2 and {Ri,R 2 } is a set of 
(2,2 )-VCRG produced by Algorithms 1-3 with respect to secret image B. 


7.3.3 Experiments for (2, 2)-VCRG 

Figure 7.1 illustrates the results of the implementation of the above three 
algorithms. Figure 7.1(a) is secret binary image B , Figures 7.1(b) and (c) 
present the two random grids produced by Algorithm 1 and Figure 7.1(d) is 
the superimposed result of these two shares ((b) and (c)). Figures 7.1(e)-g) 
illustrate the corresponding results by Algorithm 2, while Figures 7. 1(h)— (j) 
are the corresponding results by Algorithm 3. It can be easily seen from Figure 
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7.1 that the encrypted shares (see Figure 7.1(b), (c), (e), (f), (h), and (i)) are 
merely random pictures and no information about B can be obtained. Only 
when the two shares are superimposed (see Figures (d), (g), and (j)), can we 
see B by our visual system. It is worthy of notifying that there is no extra 
pixel expansion in Figures 7. 1(b)— (j). 

Figure 7.2 shows the reconstructed results by using Naor and Shamir’s 
approach for encrypting B in Figure 7.1(a). The pixel expansion of Figure 

7.2(a) is 2, while that of Figure 7.2(b) is 4 ( by applying S° = 


0 10 1 
0 10 1 


and S' 1 


0 10 
10 1 


The former does not retain the aspect ratio with 


respect to B , while the latter does. Both sizes of the results in Figure 7.2 are 
larger than that of B. 


7.3.4 Definition of Light Contrast and Performance Evalua- 
tion 

To evaluate the relative difference of the light transmissions between the trans- 
parent and opaque pixels in reconstructed image S by these random grid-based 
algorithms, we define the light contrast of S with respect to B as follows. 

Definition 3 The light contrast of a set S of VCRG produced by an encryp- 
tion algorithm for a binary image B is defined as 

^(S[g(0)])-^(S[B(1)]) 

1 J l + t?{S[B(l)}) 

where S is the superimposed result of all visual cryptograms in S . 

Let Si, S 2 , and S 3 denote the three sets of (2, 2)-VCRG produced by Algo- 
rithms 1-3, respectively. By Definition 3, the light contrasts of Si, Si, and S 3 
are c(Si) = 1/2 (= (1/2 - 0)/(l + 0)), c(S 2 ) = 1/5 (= (1/2 - l/4)/(l + 1/4)), 
and c(S 3 ) = 1/4 (= (1/4 — 0) / (1 + 0)). That is, Algorithm 1 achieves the 
highest light contrast among the three. This outcome can also be observed by 
comparing the reconstructed images in Figures 7.1(d), (g), and (j) in which (d) 
is more recognizable than (g) and (j). Note that 1 + S?{S[B{ 1)]) is introduced 
as the denominator of c(S ) in favor of a less S?(S[B( 1)]) (than a larger one) 
when two schemes have a same numerator (i.e., £?(S[B(0)])— S?(S[B(1)])). For 
instance, both of S 2 and S 3 have the same result of ^(^[^(O)]) — £?(S[B( 1)]), 
yet their ^(5'[i?(l)])’s are 1/4 and 0, respectively. Thus, c(S 3 ) > c(S 2 ) ac- 
cording to Definition 3. As we can see, the reconstructed image by S 3 (Figure 
7.1(j)) is indeed more recognizable than that by <£2 (Figure 7.1(g)) by our 
visual system. In general, we prefer a set of VCRG with a larger light contrast 
that helps our visual perception to recognize the result. Thus, Algorithm 1 is 
more preferable than the other two. 
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FIGURE 7.1 

Implementation results of Algorithms 1, 2, and 3 for encrypting binary image 
B: (a) B\ (b), (c), and (d) two encrypted shares and reconstructed image by 
Algorithm 1; (e), (f), and (g) two encrypted shares and reconstructed image 
by Algorithm 2; (h), (i), and (j) two encrypted shares and reconstructed image 
by Algorithm 3. 
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FIGURE 7.2 

Reconstructed results by Naor and Shamir’s approach for binary image B in 
Figure 7.1(a): (a) m = 2, (b) m = 4. 


We summarize the reconstructed light contrasts by these three algorithms 
in Table 7.3. 


TABLE 7.3 

Light contrasts by Algorithms 1-3 in producing 
VCRG-2. 


s 

&(S[B(0)]) 

nsm 1 )]) C {g) 

Algorithm 1 

1 

2 

0 1 

Algorithm 2 

1 

2 

1 1 

4 5 

Algorithm 3 

1 

4 

0 3 


It is noticed that various definitions of contrast in [9, 14, 1] all depend on 
pixel expansion so that they are not suitable any more to measure the effective- 
ness of our schemes. On the contrary, since we consider the light transmissions 
through different areas of the transparency, the measurement of light contrast 
is more generalized and can be applied to all kinds of schemes. 

We discuss how to generate (n, n)-VCRG in the next subsection. 

7.3.5 Algorithms of (ji,n)-VCRG for Binary Images 

Consider an h. x w binary image B and n random grids R\, R 2 , ■ ■ ■ , R n with 
the same dimension. We call ri,r 2 ,. . . ,r n the corresponding pixels of b £ B 
if all ?Vs in R^s for 1 ^ k ^ n have the same coordinates as b (if b = B[i,j], 
then rfc = Rk[i,j] where 1 ^ i ^ h and 1 ^ j ^ w). 

By extending the idea of Algorithm 2 directly, we may obtain a set of two 
out of n visual cryptograms of random grids where any pair of two out of the 
n shares can reveal the secret when superimposed. Given a binary image B : 
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we first find a random grid Ri with 3?{Ri) = 1/2. Then, we define Rk for 
2 ^ fc ^ n as follows: 


r* = { ri it & = U; 

L random -pixel () otherwise, v ' 

for each pixel rk £ Rk where rq, rq , . . . , r n are corresponding pixels of b € B. 
It is easy to see that all RC s are random grids and when 6 = 0, t(r, ® rq ) = 
/ (r i ® ri) = /(rq) = 1/2; while 6 = 1, /(r^ ® rq) = 1/4 by Lemma 1 for 
each pair of r and j where 1 ^ i ^ j ^ n. That is, &(R i [B( 0)] ® i?j[B(0)]) = 
1/2 > 1/4 = t?(Ri[B(l)]<g)Rj[B(i)]). As a result, {i?i, f? 2 , • • • , R n } produced 
in this way is a set of two out of n visual cryptograms of random grids. Yet, 
it is not a set of (n, n)-VCRG, since Condition 2 in Definition 2 fails. 

Let us extract some informative features from the idea in Algorithm 1. Let 
B = {0, 1} be a binary set. We introduce a function /: 2% x 2% — > 2$ defined 
as follows to transcribe the basic idea in Algorithm 1: 





if x = 0; 
otherwise, 


(7.10) 


for x, s,s £ 3i where s is the inverse value of s. We may say that function 
fix, s) preserves the value of s if x = 0, and reverses it otherwise (x = 1). In 
the subject of sequential circuits, the behavior of f(x, s ) is equivalent to that of 
a T flip-flop where s, x and fix, s) are the current state, toggle input, and next 
state, respectively. In the area of logical operations, fix, s) can be implemented 
by using the Exclusive-OR operation ( ® ), that is, f(x, s) = x ® s. 

Let B be a binary image and Ri be a random grid with f7{R\) = 1/2. By 
introducing function f the essential idea of Algorithm 1 for generating each 
pixel r 2 G i ?2 corresponding to ri £ Ri and b £ B can be formulated as 


r 2 =ftb,n). (7.11) 

Note that when b = 0, r 2 = rq; while b = 1, r% = rq. This is exactly the same 
as the manipulation of Step 2 in Algorithm 1. 


This critical observation is emphasized as a corollary as follows. 

Corollary 2 If Ri is a random grid with £T(Ri) = 1/2 and the corresponding 
pixel 7q G i ?2 of rq € Ri is obtained by r 2 = /(6, 7q) for each ?q £ R\ with 
any b £ then R 2 is a random grid with ^(i? 2 ) = 1/2. 

By using function f our first construction of a set of (n, ?i)-VCRG (S’ = 
{Ri, R 2 , ■ ■ ■ , R n }) with respect to B is now introduced as follows. We first 
generate n — 1 random grids R\, R 2 , . ■ ■ , R n - 1 independently with t?(Rk) = 
1/2 for 1 ^ k ^ n — 1. That is, for every pixel b £ B its n — 1 corresponding 
pixels rq,r 2 , . . . , r n _ 1 are totally random where rk € Rk for 1 ^ k ^ n — 1. 
Based upon rq, r 2 , . . . , rk, we compute Ofc for 1 ^ k ^ n — 1 by using the 
recursive formula: 
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a k = { 


r 1 

f(r k ,a k - 1 ) 


if k = 1; 
otherwise. 


Then, we find r n according to b and a„_i by 


(7.12) 


r„ =/(6,a„_i). (7.13) 

It is noticed that formula (7.11) is a special case of formula (7.13) by set- 
ting n = 2. After all r„’s € R n corresponding to all b ' s € B are computed, we 
obtain R n . Then, £ = {Ri,R 2 , . . . , R n } is reported as a set of ( n , n)-VCRG 
of B. The whole idea is formally illustrated in Algorithm 4. 


Algorithm 4. Encrypting a secret image into a set of (n, n)-VCRG 

Input: an h x w binary image B and an integer n 

Output: £ = {Ri,R 2 , . . . , Rn} constituting (n, n)-VCRG of B 

1. for (1 ^ k ^ n — 1) do 

{ generate R k as a random grid, £?{R k ) = 1/2 

} 

2. for (each pixel B[i, j], 1 < * < h and 1 < j < w) do 

2.1 { a 1 = R 1 [i,j] 

2.2 for (2 ^ k ^ n — 1) do 

{ afe = f(R k [i,j],a k - i) / /f{x, s) is defined in formula (7.10) 

} 

2.3 Rn[i,j] = f{B[i,j\,a n -\) 

} 

3. OUtput(i?i, i? 2 , • ■ • , Rn) 

Before we prove that £ = {Ri, R 2 , . ■ ■ , R n } generated by Algorithm 4 
with respect to B is indeed a set of (n, n)-VCRG of B , we explore more useful 
features among multiple random grids in the following. 

It is easy to see that two independent random grids produce another ran- 
dom grid as they are superimposed even when their light transmission is not 
1/2. We formalize this in Lemma 3, which is a generalized version of Lemma 
1. 

Lemma 3 Given two independent random grids R\ and R 2 with tV(Ri) = Ai 
and 37~(R 2 ) = A 2 , R\ (g> R 2 is a random grid with £h{Ri <g> R 2 ) = A 1 A 2 . 
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Proof For any pixel rq £ R\ and its corresponding pixel r 2 £ R- 2 , we have 
2? t*<f(r\ = 0) = Ai and 22 ^Y(r 2 = 0) = A 2 . ri®r 2 is transparent if and only 
if both of r 1 and r 2 are transparent, that is, ® r 2 = 0) = 22 t*tf(r\ = 

0) x 22 i#<f{r 2 = 0) = A 1 A 2 . Therefore, £2 ~(Ri®R 2 ) = &{R\) x 22(R 2 ) = A 1 A 2 . 

The theme of Lemma 3 can be extended for more than two random grids. 

Lemma 4 If 22 = {R\. R 2 , . . ■ ,R„ } is a set of u ^ 2 independent random 
grids with 22 {Ri) = A for 1 ^ i ^ u, then S ^ is a random grid with 22 (S^) = 
A” where S ^ = R\ <S> i ?2 ® ■ • • <8> R u ■ 

Proof We prove by mathematical induction. Consider the case of Y = 
{i?i,i? 2 }- The statement (i.e., 22{S r ) = A 2 ) is true by Lemma 3. Assume 
that the statement holds for the case of Y = {R\, R 2 , ■ ■ ■ , R u -i}, that is, S r 
is a random grid with 22{S r ) = A“ _1 where S r = i?i <g> R 2 <g> ■ • • ® R u - 1 - 
Then, we further consider 22 = {R\, f? 2 , • • ■ , Ru} = Y U {R u }- is simply 
the superimposed result of S y and R u , i.e., S y/ = S r ®R U . By Lemma 3, we 
have 22(S^) = 22{S r ® R u ) = 22{S r ) x 22{R U ) = (A"” 1 ) x A = A“. 

Since the superimposition operation ® is commutative, it is not hard to 
obtain that the results of different superimposing orders of R\, R 2 , ■ ■ . , R u are 
all the same (i.e., S y/ ). As a matter of fact, the superimposed result of any 
subset of 22 is also a random grid as indicated in Lemma 5. 

Lemma 5 Let 22 = {f?i, R 2 , . . . , Ru} be a set up u ^ 2 independent random 
grids and Y = {Ri 1 , Ri 2 , ■ . . , } C 22 where 1 ^ i\ < i 2 < • • • < i v ^ « 

and 22 (Rf) = A for 1 21 i 2, u. S y is a random grid with 22 (S r ) = X v where 
S r = R h ®R i2 ®...® Ri„ . 

The proof of Lemma 4 can be easily applied to prove Lemma 5. Con- 
sider a set of u independent random grids 22 = {Ri, R 2 , ■ ■ • , R u } where 
22 (Rk) = 1/2 for 1 < k < u. We may generate a set of u binary images 
s2 = {At, A 2 , ... ,A U } with respect to 22 in such a way that each pixel a k € A k 
is defined by formula (7.12), that is, 

_ . r\ if k = 1; 

ak ~ ^ f(r k ,a k - 1 ) otherwise, 

where a k £ A k and r k £ R k are corresponding pixels for 1 ^ k ^ u. Lemma 
6 claims that all of At, A 2 , . . . , A u are random grids with 22{A k ) = 1/2 for 
1 ^ k ^ u. 

Lemma 6 For s2 = {Ai, A 2 , . . . , A u } generated by formula (7.12) with re- 
spect to 22 = {i?i, R 2 , ■ • • , R u } where 22{R k ) = 1/2, A k is a random grid with 
22 {A k ) = 1/2 for 1 ^ k ^ u. 

Proof We prove by mathematical induction. For the case of \s2\ = 1 (i.e., 
u = 1), since ai £ A\ is equal to ri £ Ri by formula (7.12), A± is exactly the 
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same as R\. Thus, A\ is a random grid with Sf(A i) = ST(Ri) = 1/2. Assume 
that the statement holds for the case of \srf\ = u— 1, that is, A\, A 2 , . . . , A„_ i 
are random grids with £?(A k ) = 1/2 for 1 ^ k ^ u — 1. Due to the reasons 
that r u (G = 0 or 1, ^(A„_i) = 1/2, and for each pixel a u G A u , a u = 
J{r u ,a u _ i), we obtain that A u is also a random grid with SC{A k ) = 1/2 by 
Corollary 2. 

According to formula (7.12), for each pixel a k € A k , 

a k = f(r k ,a k -i) = f(r k ,f(r k -i,a k - 2 )) 

= ■■■ = f(rk,ftr k ^ 4 ,J{...,f(r 2 ,a 1 ) ...))) 

= f(r k ,f(r k - 1 ,/(. . . ,/(r 2 ,rr) . . .))). 

That is, the value of a k is determined by its k corresponding pixels 
r \ , r 2 , . . . , r k for 1 ^ k ^ u. From Lemma 6, we know that a k G A k for 
1 ^ k ^ u is a random pixel with f(a k ) = g. 

Let 'A = {R il ,R i2 , . . . , A, u } be a set of v random grids randomly selected 
from (i.e. "V C W) where 1 < < u. Let 5 I ‘^(0)(5'(0)) denote the area 

of transparent pixels in (S v ) where S®' = Ri g i? 2 <g ■ • • <g (5^ = 
Ri i (g Ri 2 (g • • • (g Now we would like to examine the light transmis- 

sion of the area of pixels in A u corresponding to 5“ 2! ’(0)(5'(0)), referred to as 
A U [S^( 0)] (A„[5 r (0)]). 

Lemma 7 

(1) ST{A U [S^{ 0)]) = 1; 

(2) ^(A u [5 y (0)]) = 1/2. 

Proof 

(1) From Lemma 4, we have = 1/2^. Consider pixel s = 0(or 

s G S'^(O)). The only chance for s = 0 is that its corresponding pixels 
ri,r 2 ,...,r u should all be transparent, i.e., ri = r 2 = • • • = r u = 0. Un- 
der this circumstance, by formula (7.14) s’s corresponding pixel a u in A u 
becomes 


a u = f(r u ,f(r u - 1 , /(..., /(r 2 ,ri) .. .))) 

= /( 0 ,/( 0 , /(..., /( 0 , 0 ) ...))) 

= 0 . 

That is, if s = 0 (or s G S^O)). then a u = 0. As a result, SI (A U [S^ (0)]) = 1. 
(2) Let — "V = W = {iJjj , Rj 2 , . . . , Rj w } where w = u — v (i.e., 
= {1,2,..., u} - {ii,i 2) . ..,*„}). From Lemma 5, we know 
that both S r and S w ' are random grids with SC (S r ) = 1/2“ and S?(S^') = 
1/2 U ~ V . Since the order of random grids does not affect the result of super- 
imposition, without losing generality, let (ji, J 2 , • ■ • ,jw) = (1,2 and 

(ii, i 2 , • • • , i v ) = {w + 1, w + 2, . . . , u). That is, W = {f?i, f? 2 , . . . , i?„,} and 
y = {R w+ i, R w+ 2 , ■ ■ ■ , R u }- (This can easily be done by renaming all of the 
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random grids.) We focus on pixel t = 0 in S 1 ' (or t £ 5^(0)) only. Its corre- 
sponding pixels r w +i £ R w +\,r w + 2 £ R w + 2 , • • ■ . r u £ R u should all be trans- 
parent, i.e., r w + 1 = r w +2 = • • • = r u = 0. Consequently, its corresponding 
pixel a u £ A u becomes 

a u = f(r u , f(r u - 1 , • • ■ , f(r w +i,f(r w , f(r w - i, • • • , f(r 2 , n )) . . .)))) 

= /( 0, /( 0, . . . , /( 0, f(r w , f(r w - 1 , . . . , f(r 2 , n)) . . .)))) 

= f(r w , f{r w _r, . . . , /(r 2 , n) . . .)). 

From Lemma 6, we have / (a u ) = 1/2. In summary, if f = 0 in (or 
f S S* (0)), then s(a u ) = 1/2; therefore, £? (A U [S r (0)]) = 1/2. 

Lemmas 5-7 investigate the properties of u random grids in ^ = 
{i?i, R 2 , • • - , and another u random grids Ai, A 2 , . . . , A u produced by 
formula (7.12) with respect to for u ^ 2. Now we pay attention to Algo- 
rithm 4. Give a secret image B and n participants, Algorithm 4 first produces 
a set of n — 1 independent random grids, namely = {R\, R 2 , . . . , R n - i } , 
based upon which Ax, A 2 , . . . , A n _\ are generated, and then R n is produced 
according to A n ~i and B. We claim that R n is a random grid and the super- 
imposed result of any group of less than n shares is also a random grid. 

Lemma 8 Give a secret image B and a set of independent random grids 

& = {R\, R 2 , . . . , R n - 1 } , 

(1) R n generated by formula (7.13) is a random grid with 3T(R n ) = 1/2; and 

(2) S'® is a random grid with 2T{S®) = l/2 d where , i?, 2 , . . . ,Ri d } C 

U {R n } and S® = R^ 8 Ri 2 <8 ■ ■ ■ <8 Ri d - 

Proof 

(1) By setting u = n — 1 in Lemma 6, we know that A n -i is a random grid 
with ^(A n - 1 ) = 1/2 (or f(a n -i) = 1/2) for a„_i £ A n - t , For r n £ R n [B{ 0)], 
r n = /(0, a„_i) = a„_i; while r n £ R n [B{ 1)], r n = /( l,a n _i) = a n -i- It 
implies that both i?„[B(0)] and R n [B( 1)] are areas of random grids with 
i?„[B(0)] = 1/2 = i?„[B(l)]. By the principle of combination, R n is a random 
grid with 3?(R n ) = 1/2. 

(2) Since the generation of R n is different for Ri, R 2 , . . . , R n -i (in fact, R n 
is generated from B and A n -\ which depends upon Ri, R 2 , . . . , R„.-i (see for- 
mulae (7.12) and (7.13))), there are two cases with regard to the constituents 
of @ : Case 1: R n ^ 3i\ and Case 2: R n £ S>. 

For Case 1, since all random grids in are independently generated, S® 
is a random grid according to Lemma 5 with S^(S®) = t7(S®[B( 0)]) = 
&(S s [B( 1)]) = l/2 d . 

Regarding Case 2, assume that S> = {Ri 1 , Ri 2: . . . , Ri i _ 1 , R n }. Let ££ = 
{A,;, , R l2 , . . .,R ld _ 1 } (i.e., @ = ££ U{A„}) and = R il <8 R i2 <8 • • • 8 Ri^. 
From Lemma 5, we realize that S®’ is a random grid with = l/2 d_1 . 

Besides, by setting u = n — 1 and v = d — 1 in Lemma 7(2), we obtain 
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& (A n _i[S-^ (0)]) = 1/2. Consider any pixel a n -% G A n _\ [S^ (0)] and its 
corresponding pixels s l € 5^(0) (i.e., S l = r ^ ® r.j 2 0 • • • 0 ri d _ 1 = 0 where 
r lk G R lk for 1 < k ^ d - 1), h G B and r n G R n . If b = 0, r n = /(&, a n _i) = 
/(0, a n _i) = a n _i; otherwise ( b = 1), r„ = /( 1, a„_i) = a n _i. We obtain that 
x(r„) = 1/2 on condition that s l G S ,-Sf (0). It means that I? {R n [S^ {$)}) = 
1/2. 

To explore the light transmission of S®(= S ^ 0 R n = (S'^ f (0) 0 
R n [S^ (0)]) U (S^(l) 0 R n [S^(l)))), we only need to consider the light trans- 
mission of 5^(0) 0 R n [S^ (0)], since no light can pass through the area of 
S^( 1) ® R n [S^( 1)] (note that S^(l) is the area of opaque pixels in S*). 
Due to the facts that S? (S'- 5f ) = l/2 d_1 = 0)) (by Lemma 5) and 

3?(R n [S^^}) = 1/2 (proved previously). We have <^(5®) = 3?(S^( 0) 0 
i?n[^(0)]) = P(S*m x Sr{R n [S*{ 0)]) = {l/2 d ~ l ) x (1/2) = l/2 d by 
Lemma 3. 

Based upon the above discussions, we prove the correctness of Algorithm 

4 in Theorem 2. 

Theorem 2 Given a binary image B, $ = {i?i, R 2 , . . . , !?„} produced by Al- 
gorithm 4 mth respect to B is a set of (n,n)-VCRG of B. 

Proof We prove that $ = {R±, R 2 , ■ ■ ■ , R n } meets the three conditions in 
Definition 2 respectively in the following. 

(1) From Step 1 of the algorithm, we realize that & = {i?i, R 2 , . . . , R n - 1 } are 
truly random grids with I?{Ri) = 1/2 for 1 ^ i ^ n — 1. From Lemma 8(1), 
R n is also a random grid with £T(R n ) = 1/2. Thus, all of R\, f? 2 , ■ ■ . , R n are 
random grids with a light transmission of 1/2. Condition 1 of Definition 2 
holds. 

(2) Regarding any subset of § with d(< n) random grids, namely S> = 
{Ri i: Ri 2 , . ■ . , Ri d } C S', 1 ^ «i < *2 < ••• < id ^ n, we have that S'® 
is a random grid with ^(S®) = l/2 d from Lemma 8(2). Condition 2 holds. 

(3) Let M = {Si,S 2 ,...,f?„_i}, S m = R 1 0 i? 2 0 • • • <8> R n -i and s r G S m , 

r n G i?„, b £ B as well as ry G ib for 1 ^ ^ n — 1 be corresponding pixels. 

By Lemma 4, we know £T(S^) = &(S m [B(l)}) = £r(S m [B(f)))) = l/2 n ~ 1 . 
We focus on pixel s r G S^ that is transparent. The only case for s r = 0 is 
ri = r 2 = • • • = r n _i = 0. In this case, their corresponding pixel a„_ 1 G 
A n _ 1 is also 0 (or £T(A n _i[S^( 0)]) = 1, see also Lemma 7(1) by setting 
u = n — 1 and = ££). Thus, when b = 0, r n = f(p,a n ~i) = /( 0,0) = 0, 
while b = 1, r n = f(p, a n _i) = /(l, 0) = 1- We obtain that ri 0 r 2 0 • • • 0 
r n - 1 0 r n = s r 0 r ra = s r 0 0 = s r for 6 = 0; while ri ® r 2 0 • • • 0 r n _i 0 r n = 
s r 0 r n = s r 0 1 = 1 for b = 1. That is, S?(S s [B( 0)]) = £?(S^[B( 0)]) = 
l/2 n ~ 1 > &(S*[B(1)]) = 0. Condition 3 holds. 

Since all of the three conditions in Definition 2 hold, we conclude that 

5 = {Ri, R 2 , ■ ■ ■ , Rn} generated by Algorithm 4 is a set of (n, ?r)-VCRG of B. 
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Corollary 3 is an immediate result from Theorem 2. 

Corollary 3 {^{S s [B(Q)\), ST (S e [B {!)])) = (l/2 n -\0) where S’ = 

{i?i, i? 2 ) • • • > Rn} is produced by Algorithm 4 with respect to B and S s = 

R\ 8 i?2 8 ■ ■ ■ R n ■ 

We give a simple example for n = 3 to explain the relationship among 
corresponding pixels b £ B, r\ £ i?i, r 2 £ i? 2 , r 3 £ R 3 , ai £ A\, and 02 £ A 2 
in Algorithm 4. 

Example 1. Consider n = 3 and a secret image B. Algorithm 4 first gener- 
ates R\ and R 2 independently; then produces A\ and A 2 by formula (7.12); 
at last finds R 3 depending on B and A 2 according to formula (7.13). Let 
S = {i?i, i? 2 j i? 3 }. Table 7.4 summarizes all of the possible combinations of 
corresponding pixels b £ B : r 1 £ Ri, and r 2 £ R 2 ', and their corresponding 
results of ai(= ri) £ A\, a 2 (= /(»~ 2 ,ai)) £ A 2 , and r 3 (= f(b,a 2 )) £ i? 3 ; as 
well as the superimposed results of rr 8 r 2 , rr (g» r 3 , i '2 8 r 3 , and r± 8 r 2 8 r 3 . 
Table 7.5 lists the light transmissions of the corresponding results in Table 
7.4. 

It is seen from Tables 7.4 and 7.5 that all of i?i, R 2 , i? 3 , A lt A 2 are 
random grids with a light transmission of 1/2. Besides, 3?(S s ’[B{ 0)]) = 
&(S 3 [B( 1)]) = 1/4 and &{S 9 [B{ 0)]) = 1/4 > 0 = ^(S®[B(1]) where 
^(C ^) = {i?i,i? 2 }, {7?i,i? 3 } or { i? 2 , R 3 } • It means that each group of two 
random grids obtains no information about B{ 0) or B{ 1) when superimposed 
(thus, no information about the colors of pixels in B can be found), while B( 0) 
and B( 1) can be identified from S s due to the difference of their light trans- 
missions, that is, we see B out of S s because of 47{S e [B( 0)]) > &(S s [B( 1)]). 

TABLE 7.4 

All possible combinations of b , r 3 , and ?' 2 , the corresponding results 
of cii (= ri), a 2 = /(r 2 ,ai), r 3 = f(b,a 2 ), and n 8 r 2 , n 8 r 3 , 
r 2 8 r 3 as well as r\ 8 V 2 8 r 3 by Algorithm 4 for (3, 3)-VCRG. 


b 

n 

ai 

T2 

«2 

T.s 

ri 8 r 2 

ri 8 r 3 

r 2 8 r 3 

ri 8 r 2 8 r 3 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 




1 

1 

1 

1 

1 

1 
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1 

1 

0 

1 

1 

1 

1 

1 

1 




1 

0 

0 

1 

1 

1 

1 

1 

0 

0 

0 

0 

1 

0 

1 

1 

1 




1 

1 

0 

1 

0 

1 

1 


1 

1 

0 

1 

0 

1 

1 

0 

1 




1 

0 

1 

1 

1 

1 

1 


Algorithm 4 can be viewed as the generalization from the idea in Algorithm 
1. Such knowledge can be easily adapted to generalize the ideas in Algorithms 
2 and 3. Algorithms 5 and 6 are the results accordingly. 
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TABLE 7.5 

Light transmissions of the corresponding 
pixels in Table 7.3. 


b 

*(ri) 

s(ai) 

^2) 


'■'(73) 

0 

1/2 

1/2 

1/2 

1/2 

1/2 

1 

1/2 

1/2 

1/2 

1/2 

1/2 


s(ri ® r 2 ) 

s{r 1 (8 )r 3 ) 

^(r 2 ® r 3 ) 

s(ri ®r 2 ® r 3 ) 

1/4 

1/4 

1/4 

1/4 

1/4 

1/4 

1/4 

0 


Algorithm 5—6. Encrypting a secret image into n random grid as a set 
of (n,n)-VCRG (based upon Algorithms 2 and 3, respectively) 

Input: an h x w binary image B and an integer n 

Output: a set of n random grids £ = {Ri, R 2 , ■ ■ ■ , R n } constituting (n,n)- 
VCRG of B 

Algorithm 5. 

1. for (1 ^ k ^ n — 1) do 

{ generate Rk as a random grid, £T{R k ) = 1/2 

} 

2. for (each pixel B[i,j], 1 ^ i ^ h and 1 ^ j ^ w) do 

2.1 { ai = Ri[i,j] 

2.2 for (2 ^ k ^ n — 1) do 

{ a k = f(R k [i,j],a k - 1) 

} 

2.3 if {B[i,j] = 0) then R n [i,j] = f(B[i,j],a n - 1 ) 

( /(0)^n— l) 0"n— l) 

else R n [i,j] =random_pixel() 

} 

3. OUtput(f?i, i?2, • • • , Rn) 

Algorithm 6. 

1. for (1 ^ k ^ n — 1) do 

{ generate R k as a random grid, tV(R k ) = 1/2 

} 
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2. for (each pixel B[i,j], 1 ^ i ^ h and 1 ^ j ^ w) do 

2.1 { ai = Ri[i,j] 

2.2 for (2 ^ k ^ n — 1) do 
{ a k =f(R k [i, i],Ofe-i) 

} 

2.3 if ( B[i,j ] = 0) then R n [i,j] =random_pixel() 
else R n [i,j] = f(B[i,j],a n _ i) (= /(l,a n _i) = a„_i 

} 

3. Output (Ri, i? 2 , • 7?n) 

Theorem 3 declares the validity of Algorithm 5 and 6 in producing (n, n)~ 
VCRG. 

Theorem 3 Given a secret binary image B, S = {R±,R- 2 , ■ ■ ■ ,R n } produced 
by Algorithms 5 or 6 with respect to B is a set of (n, n)-VCRG of B. 

The statements in the proof of Theorem 2 can be easily applied to prove 
Theorem 3. We omit the details here. 

In Algorithm 5, if b = 0, r n = f(b,a n - 1 ) = /(0, o„_i) = a n - 1 , otherwise 
( b = 1) r n =random_pixel( ). Consequently, we obtain £?( y S s [B( y 0)]) = 1/2” -1 
by Corollary 3 and Z?{S g [B(l)\) = 1/2” because all pixels in Rk[B( 1)] 
are random pixels for 1 ^ k ^ n. Regarding Algorithm 6, if b = 0, 
r n =random_pixel(); otherwise (6 = 1), r n = f(p, a„_i) = /(l,a„_i) = a n -i- 
Thus, we have &{S s [B{ 0)]) = 1/2” since 3A(Sk[B{ 0)]) = £?(Rk) = 1/2 for 
1 ^ k ^ n, and ^(5 ,<? [R(1)]) = 0 since the only condition for rq ® r 2 <B> ■ ■ • <S> r n 
to let through the light (i.e. , rq = r 2 = ■ ■ ■ = r„_i = r ra = 0) would never 
occur (once rq = r 2 = ■ • • = r„_ i = 0, we have a ra _i = 0; but 6=1 causes 
r n = a n - 1 = 1). We obtain the following corollary. 

Corollary 4 (^(5^ [R(0)]), &(S e [B(l)})) = (1/2”" 1 , 1/2”) or (1/2”, 0) 
where $ = {R\, R 2 , ■ ■ ■ , R n } is produced by Algorithms 5 or 6, respectively, 
with respect to B and S s = R\ ® 1? 2 ® • • ■ <8> R n ■ 

The light contrasts of Algorithms 4-6 in point of Definition 3 are summa- 
rized in Table 7.6. It is seen from Table 7.6 that among the three approaches, 
the light contrast obtained by Algorithm 4 is the best. 
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TABLE 7.6 

Light contrasts by Algorithms 4-6 for (n,n)-V CRG. 



ns[R( o)]) 

ns[B( i)]) 

c(<?) 

Algorithm 4 

1/2" -1 

0 

1/2"" 1 

Algorithm 5 

1/2" -1 

1/2" 

1/(2" + 1) 

Algorithm 6 

1/2" 

0 

1/2" 


7.3.6 Algorithms of (n,n)-VCRG for Gray-Level and Color 
Images 

In Shyu [12], the encryption algorithms of (2, 2)-VCRG for gray-level and color 
images were generalized from those for a binary image. We apply the same 
reasoning and skills adopted by Shyu in [12] to extend the binary (n, n)-VCRG 
algorithms to cope with gray-level and color images. 

According to Ref. [12] , we simply transform a gray-level image G into its bi- 
nary version H by some halftone technology and encrypt the binary equivalent 
by using the aforementioned algorithms directly. Let Encryption-VCRG(B, n) 
denote the procedure of applying Algorithms 4, 5, or 6 to obtain (n, n)-VCRG 
with respect to binary image B . Algorithm 7 describes the idea formally. 

Algorithm 7. Encrypting a gray-level image into a set of (n, n)-VCRG 
Input: an h x w gray- level image G and an integer n 

Output: a set of n random grids $ = {Ri, R 2 , . . . , R n } constituting a VCRG- 
n of G 

1. H = Jtf(G) // Jtf(G) is a halftone function with respect to G 

2. (i? 1; i? 2 , • • • , R n ) = Encryption -VC RG(H, n ) 

/ / Encrypt H by Algorithms 4, 5, or 6 directly 

3. OUtput(i?i, R 2 , . . . , Rn) 

Regarding the (n, n)-VCRG for a color image, we follow the experience 
from Ref. [12] where the binary (2, 2)-VCRG encryption algorithms were ex- 
tended to their color versions by utilizing skills including color decomposition, 
halftoning, and color composition. Specifically, we decompose a color image 
P into the c, m and y components (which are the primitive colors in the sub- 
tractive model), namely Pc, P m , and P y ; halftone each of them to be P c , P m , 
and P v such that each pixel p x £ P x is either a: or 0 where x £ {c, m, y} and 
encrypt the three halftone images into (R®, R 2 , . . . , R“), ( R R™, . . . , R™), 
and (Ri, R 2 , . . . , RJ[) by using any of Algorithms 4, 5, or 6 where the cor- 
responding sets of binary colors are {c, 0}, {m, 0}, and {y, 0}, respectively 
(instead of {1,0}). Let Ri denote the image composed by R?, R/ 1 and Rf, 
i.e., Ri = (R^, -R™, Rj) for 1 ^ ^ n. Then, $ = {Ri, R 2 , . . . , R n } can be 

reported as a set of color (n, n)-VCRG of P. It means that only when all R, ’s 
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are superimposed can we see P , while any group of less than n shares obtains 
nothing but a color random grid. 

Let Encrypt .cVCRG(P x , x , n) denote the procedure of encrypting P x 
into n shares R x , P 2 , • ■ • , R„ in terms of binary color set {*,0} where 
x £ {c, m,y}. It is easy to implement Encrypt. cVCRG(P x by using Al- 
gorithms 4, 5, or 6 as long as we take 0 and x as the inverse to each other and 
modify random_pixel() to return 0 or a: randomly. Algorithm 8 summarizes 
the whole idea of producing color (n, n)-VCRG for a color image. 

Algorithm 8. Encrypting a color image into a set of (n, n)-VCRG 
Input: an h x w color image P and an integer n 

Output: a set of n color random grids S = {Pi, R 2 , . . . , R„} constituting a 
(n, n)-VCRG of P 

1. Decompose P into (P c ,P m ,P y ) 

2. for (x £ {c,m,y}) do P x = Jtf(P x ) 

// Jt?(P x ) is an :r-colored halftone function so that for each p x £ P x , 
p x = x or 0 

3. for (x £ {c,m,y}) do (R x , P 2 , . .., R„)= Encrypt .cVCRG(P x : , x , n ) 

4. for (1 < i < n) do R t = (P?, P” Pf) 

/ / color composition of R f , R™, and Pf 

5. OUtput(Pi, P 2 , ■ • -,Rn) 

Based upon the statements in the proofs of Theorems 2 and 3 as well as 
those for color (2, 2)-VCRG in Ref. [12], we have the following consequence. 

Theorem 4 Given a color image P, S — {Pi, P 2 , • • • , P n } produced by Al- 
gorithm 8 with respect to P is a set of color ( n,n)-VCRG of P. 


7.3.7 Experiments for (n, n)-VCRG 

We designed four experiments by computer simulations to verify the feasibility 
and applicability of the VCRG algorithms. Experiment 1 was designed to test 
Algorithms 4, 5, and 6 to obtain sets of VCRG-3 for a binary image. Experi- 
ments 2 and 3 focused on producing sets of VCRG-3 for gray-level and color 
images, respectively. The sets of VCRG-4 were tested in Experiment 4. All 
computer programs in these experiments were coded in Borland C+- 1- Builder 
and run in a PC with Windows. 

Experiment 1: Encrypting a binary image to obtain VCRG-3. 

In this experiment, we adopted Algorithms 4, 5, and 6 to produce three sets 
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of VCRG-3, respectively, for binary image B as in Figure 7.3. Figure 7.4 illus- 
trates the implementation results of Algorithm 4 where (a), (b), and (c) are 
the three random grids produced, namely Rf, Rf, and Rf, respectively; (d), 
(e) and (f) are the superimposed results of Rf 0 Rf, Rf 0 Rf, and Rf 0 Rf, 
respectively; and (g) is the result of Rf 0 Rf 0 Rf. 




FIGURE 7.3 

Binary image B in Experiment 1. 

We see from Figure 7.4 that (a)-(f), including Rf, Rf, Rf and the super- 
imposed results of all groups of two out of the three shares, are merely random 
grids from which no secret can be obtained, whereas (g) Rf 0 Rf 0 Rf, the 
superimpositiion of the three random grids, reveals B to our visual system. 
As a result, {Rf , Rf, i?|} produced by Algorithm 4 is indeed a set of VCRG-3 
of B. It is lucid that Figure 7.4 provides some visualized evidence to Theorem 
2 . 

Figures 7.5 and 7.6 show the corresponding results of Algorithms 5 and 6 
for VCRG-3 with respect to B where {Rf, Rf, Rf} and {Rf,Rf,Rf} are the 
two sets of random grids produced by Algorithms 5 and 6, respectively. It is 
seen from Figure 7.5 and 7.6, {Rf, Rf, Rf} and {Rf,Rf,Rf} are surely two 
sets of VCRG-3 of B. The correctness of Theorem 3 is visually shown here. 

In summary, based upon Figures 7.4-6, Rf and Rf 0 Rf are random grids 
with S?(Rf) = 1/2 (see Figures 7.4(a)-(c), 7.5(a)-(c), and 7.6(a)-(c)) and 
&(Rf 0 (Rf) = 1/4 (see Figures 7.4(d)-(f), 7.5(d)-(f), and 7.6(d)-(f)) for 
1 ^ * 7^ j ^ 3 and a £ {4,5,6}. By comparing the reconstructed images, i.e., 
R}0 Rf0 Rf, Rf0Rf0 Rf and Rf 0 Rf 0 Rf (see Figures 7.3(g) , 7.4(g) , and 
7.5(g), respectively), we realize that Rf 0 Rf 0 Rf (by Algorithm 4) attains 
the highest light contrast, while Rf 0 Rf 0 Rf (by Algorithm 5) the lowest. 
In fact, these results are foretold by Table 7.6: c(S. 4) = 1/4, c(£] 5) = 1/9, 
c(£ e ) = 1/8 for n = 3 where £ a = {Rf, Rf, Rf} for a € {4, 5, 6}. 

Experiment 2: Encrypting a gray-level image to obtain VCRG-3. 

Figure 7.7 illustrates the experimental results of applying Algorithm 7 to pro- 
duce a set of VCRG-3 for a gray-level image. Figure 7.7(a) is the gray-level 
image G to be encrypted; (b) shows the halftone version H of G by using 
the error diffusion technology; (c), (d), and (e) present the outcomes of Al- 
gorithm 7 where Encryption _VCRG(H, 3) was implemented by Algorithm 4, 
namely Rf, Rf and Rf, respectively; (f), (g), and (h) give the superimposed 
results of Rf0Rf, Rf0 Rf and Rf0Rf, respectively; and (i) depicts that of 
Rf 0Rf0Rf. As seen from Figure 7.7, Rf, Rf, and Rf and the superimposed 
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FIGURE 7.4 

Implementation results of Algorithm 4 for VCRG-3 with respect to B: (a) R 
(b) Ri (c) R|; (d) Rf ® Rj, (e) ® Rf , (f) ® i?|; (g) R* ® R\ ® Rf . 
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FIGURE 7.5 

Implementation results of Algorithm 5 for VCRG-3 with respect to B : (a) R\, 
(b) R\, (c) -R|; (d) R\ (g) R%, (e) R\ £> R\, (f) R\ <g> R\] (g) R\ <3> R\ <g> Rf. 


© 2012 by Taylor & Francis Group, LLC 



Visual Cryptography and Random Grids 


211 



FIGURE 7.6 

Implementation results of Algorithm 6 for VCRG-3 with respect to B : (a) R \ , 
(b) 1 ? 2 > ( c ) R®; (d) R® <8> R®, (e) R® <g> Rf , (f) 1 ?® ® R®; (§) R® <S> R® ® R® ■ 
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results from any two out of them are nothing but random pictures, where 
Rf ® ® i?| reveals H , and consequently G. We realize that {1?^, R\ , 1?|} is 

a set of VCRG-3 with respect to G. 



FIGURE 7.7 

Results of Algorithm 7 where Encryption -VCRG(H, 3) was implemented by 
Algorithm 4 with respect to gray-level image G in Experiment 2: (a) G; (b) 
halftone version H of G; (c) R\, (d) R\, (e) Rf; (f) R\®R\, (g) R\ (h) 

r\ ® Ri ; 0) R\ ® Rt ® Ri- 
vet {I?f , R\, i?|} and {Rf, R®, R®} denote the outcomes of Algorithm 7 
when Encryption _VCRG{H, 3) was implemented by Algorithms 5 and 6, re- 
spectively, with respect to G. Figures 7.8(a) and (b) are the superimposed 
results of R\® R\® R\ and R\ £g> I?® ® -^ 3 > respectively. It is noted that the 
three encrypted shares and the superimposed result of any group of two out 
of the three shares are indeed random grids that are omitted here. 

The feasibility and applicability for Algorithm 7 to encrypt a gray-level 
image into VCRG-3 are demonstrated in a visual sense from Figures 7.7 and 
7.8. Obviously, implementing Encryption JVCRG(H, 3) based upon Algorithm 
4 makes Algorithm 7 achieve the highest contrast (while that based upon Al- 
gorithm 5 is the worst). 

Experiment 3: Encrypting a color image to obtain color VCRG-3. 

We tested Algorithm 8 with respect to a color image for obtaining color 
VCRG-3 in this experiment. Figure 7.9(a) is the color image P to be en- 
crypted; (b), (c), and (d) are P c , P m , and P y , which are the c, m, and y 
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FIGURE 7.8 

Reconstructed results of VCRG-3 with respect to G : (a) Rf g R\ g R 3 ; (b) 

R? g R\ 0 R%. 

components of P, respectively; (e), (f), and (g) are P c , P m , and P v which are 
the c-, m-, and y-colored halftone images (by error diffusion) of P c , P m and 
P y , respectively. 

By Step 3 of Algorithm 8, P x would be encrypted into {R x , R£, R 3 } by 
Ey crypt -cVCRG(P x , x, 3) for x S {c,m,y}. When Ey crypt -cVCRG(P m , 
m, 3) was based upon Algorithm 4, Figure 7.10 evidences the effectiveness of 
{R™, R™, R™} for being a set of m-colored VCRG-3 with respect to P m in 
which (a)-(f) are the results of R™, R™, R™, R™ g R™, R™ ® R™, and 
R™ g R™, respectively; and (g) is that of R™ g R™ g R™. Regarding P c 
and P y , the corresponding results are similar to Figure 7.10 so that we simply 
omit them. 

The encrypted monochromatic-colored shares P^ , P™ and P y were further 
composed to obtain color random grid R, = {P£,P™,P y } for 1 < * ^ 3 in 
Step 4 of Algorithm 8. We show the corresponding results in Figure 7.11 where 
(a)-(c) are color random grids Ri, R2, R3; (d)-(f) give results of Ri <g R2, 
Ri <g R 3 , R 2 (g R3, respectively; and (g) shows that of R\ g R2 ® R3. When 
we implemented Eycrypt.cVCRG(P x , x , 3) is based upon Algorithm 4, 5, or 
6. The correctness of Theorem 4 holds in a visual sense from the results of 
Figures 7.8-10. 

Experiment 4 : Obtaining VCRG-4. 

From the above analytic and experimental results, we know that Algorithm 
4 achieves the higher light contrast as compared to Algorithms 5 and 6 for 
binary and gray-level images, so does Algorithm 8 based upon Algorithm 4 as 
compared to those based upon Algorithms 5 and 6 for a color image. We only 
tested Algorithm 4 for binary VCRG-4 and Algorithm 8 based upon Algo- 
rithm 4 for color VCRG-4 here. Figure 7.12 summarizes the results of binary 
VCRG-4 where (a) is the binary image B encrypted; (b)-(e) are Ri, R 2 , R3, 
R4 produced by Algorithm 4; (f) presents the result of Ri(gR2; (g) shows that 
of Ri g R2 g R 3 ; and (h) gives that of Ri g R2 g R3 g R4. Even though the 
superimposed results from other groups of less than four shares are not shown 
here, they are really random grids as expected. It is seen from Figure 7.12 
that only when all four shares are superimposed can we see R, while no group 
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FIGURE 7.9 

(See color insert.) Results of Steps 1 and 2 of Algorithm 8 for VCRG-3 with 
respect to color image P in Experiment 3: (a) P; (b) P c , (c) P m , (d) P y ; (e) 
P c , (f) P m (g) PC 
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FIGURE 7.10 

(See color insert.) Results of Step 3 of Algorithm 8 with respect to P m where 
Ey crypt _cV C RG (P m , m, 3) was based upon Algorithm 4: (a) R™, (b) R™, 
(c) Rf ; (d) R™ ® R™, (e) Rf ® R™, (f) R™ ® R™; (g) R™ ® R™ ® R™. 
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FIGURE 7.11 

(See color insert.) Results of Algorithm 8 for VCRG-3 with respect to P : (a) 
Ri, (b) R 2 , (c) R 3 \ (d) RitgtR- 2 , (e) R 3 ®R 3 , (f) R 2 ®R 3 ; (g) Ri<g)R 2 <g)R 3 
(based upon Algorithm 4); (h) R 1 ® R 2 <S> R 3 (based upon Algorithm 5); (i) 
R ± (8 R 2 ® R 3 (based upon Algorithm 6). 
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of less than four shares tells anything about B. {Ri, R 2 , R 3 , R 4 } is indeed a 
set of VCRG-4. 



(g) 

FIGURE 7.12 



Results of Algorithms 4 for VCRG-4 with respect to binary image B : (a) B\ 
(b) i?i, (c) R 2 , (d) R 3 , (e) i? 4 ; (f) i?i 0 R 2 ; (g) R\ 0 R 2 0 R 3 ; (h) i?i 0 R 2 \ 
(g) Ri ®R 2 0i ? 3 0 Ra- 


Since n = 4 in this experiment, we have ^7{Ri) = 1/2 (see Figures 7.12(b)- 
(e)), 3?(Ri 0 Rj) = 1/4 (see (f)), and &(Ri 0 Rj 0 Rk ) = 1/8 (see (g)) for 
1 ^ j / j / fc ^ 4. Further, from Table 7.6 we know that the light contrast 
of Algorithm 4 is 0 (^ 4 ) = 1/8 for n = 4. Figure 7.13 gives some experimental 
results of Algorithm 8 for color VCRG-4 where Eycrypt_cVCRG(P x , x, 4) 
was based upon Algorithm 4 with respect to P (see Figure 7.9(a)). Figures 
7.13(a)-(d) are the color random grids Ri, R 2 , R3, Ri produced; (e) presents 
the result of Ri 0 R 2 ; (f) shows that of Ri 0 R 2 0 R 3 \ and (g) gives that of 
Ri 0 R 2 0 R 3 0 R4. As seen from Figure 7.13, we realize that {Ri 0 R 2 0 
R3 0 -R 4 } is a set of color VCRG-4 of P. 

The results of the above four experiments are visualized evidences to the 
correctness of Theorems 2-4. The proposed schemes (Algorithms 4-8) in pro- 
ducing VCRG-n for a secret image are feasible and applicable. Among the 
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FIGURE 7.13 

(See color insert.) Results of Algorithms 8 where Encrypt -cVCRG (P x , x , 4) 
was based upon Algorithm 4 for VCRG-4 with respect to P (Figure 7.9(a)): 
(a) Ri, (b) R 2 , (c) R 3 , (d) R 4 ; (e) Ri <g> R 2 ; (f) R\ <S> R 2 ® R 3 ', (g) Ri <S> 

R 2 R 3 ® Ra- 
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approaches, Algorithm 4 (Algorithm 8 based upon Algorithm 4) is the most 
effective scheme in terms of light contrast for binary or gray-level (color) im- 
ages. 

It is noticed that when we adopt the light contrast to measure the recon- 
structed result for a conventional n out of n visual secret sharing scheme [9], 
the best result is l/2 n_1 . That means that Algorithm 4 achieves the same 
best light contrast. Moreover, it is so appealing that these schemes neither 
induce any extra pixel expansion nor require encoding basis matrix. Those 
approaches in conventional visual cryptography suffer from the disadvantage 
of the inevitable pixel expansion, which increases exponentially as n increases 
(and additionally increases as c or |"log 2 c] for the color cases where c is the 
number of colors in the secret image), in the basis matrices. Table 7.7 summa- 
rizes the pixel expansions needed by some efficient n out of n visual crypto- 
graphic schemes in the literature and our (n, n)-VCRG schemes. Owing to the 
reason that the size of the encrypted shares and reconstructed image would 
not be expanded, our schemes based upon random grids are more attractive 
than those in conventional visual cryptography for both theoretical concerns 
and practical applications. 


TABLE 7.7 

Comparison of pixel expansions for conventional (n, n) visual 
cryptographic and (n, n)-VCRG schemes. 


binary 

color 


Naor and Shyu 
Shamir [9] [13] 

Blundo et al. 

[3] 

Shyu 

[11] 

Shyu 

[13] 

2" _1 1 | 

I (c- l)2 n " 1 -c+2 

I if n is odd; 

1 c(c — 1)2” -2 — c 
[ otherwise 

riog 2 c| x 2 n— 1 

1 



7.4 Concluding Remarks 

In this chapter, we propose novel schemes for visual secret sharing using ran- 
dom grids. At first, we give a new definition for the visual cryptograms of 
n(^ 2) random grids with respect to a binary image. Based upon the defini- 
tion, we design effective algorithms, prove their correctness formally, analyze 
the light contrast in the reconstructed image, and demonstrate their feasi- 
bility by computer simulations. By exploiting the skills of halftone and color 
decomposition in Ref. [12], the enhanced algorithms are also developed and 
verified to deal with gray-level and color images. 
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The proposed schemes incorporate human visual intelligence with infor- 
mation security in such a way that no computation but only human vision 
is needed in the decryption process. They provide cost effective, handy, and 
portable solutions to image encryption or sharing even for inexperienced users, 
especially for circumstances where no computer can be accessed. Since a secret 
image can be encrypted/shared among n{^ 2) participants (instead of only 
two), our approaches extend and generalize the studies in Refs. [12, 7] such 
that the applicability of image encryption or sharing can be broadened to a 
greater extent. 

The n shares of random grids generated by our VCRG-?r algorithms work 
well just like those shares by the conventional n out of n visual secret sharing 
schemes based upon the definition of Naor and Shamir [9]. However, the pixel 
expansion in our schemes is 1 for both of the binary and color images, while 
that in Ref. [9] is 2"” 1 for the binary case and that in Ref. [11] is |"log 2 c] x2" _1 
for the color image containing c colors. Therefore, the size of the encoded 
shares by our schemes would be much smaller (the same as the secret image). 
Further, the sophisticated encoding basis matrices in Refs. [9, 5, 4, 8, 14, 
2, 1, 3, 10, 6, 11] are no more needed in our schemes. Regarding the visual 
perception in the reconstructed images, our Algorithm 4 achieves the same 
light contrast as good as the best n out of n visual secret sharing scheme 
devised in Ref. [9]. These clarify the superiority of our schemes. 

Our encryption algorithms can be easily hardwired by incorporating a 0/1 
random number generator with T flip-flops or Exclusive-OR gates. It would 
be an interesting challenge to design a special VCRG hardware for image 
encryption. In fact, many research topics in conventional visual cryptography 
could be reexamined in view of random grids. 
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8.1 Introduction 

To describe a visual cryptography scheme we encode the encryption of a pixel 
by Boolean matrices. The rows represent the slides and the columns represent 
the different subpixels. 

For example, the encoding illustrated in Figure 8.1 is described by 

/0 1 0 1 \ 

M = 0 0 1 1 . 

\0 1 1 0 / 

To describe the random decision, which must be made when encoding a 
pixel, we use multisets that contain all possible choices with the right fre- 
quency. 

This leads to the formal definition of a visual cryptography scheme. 

Definition 1 Let T be any access structure for n persons. A visual cryptog- 
raphy scheme is a pair of multisets SXJlb and 9Jt w of Boolean n x m matrices. 
Which satisfy: 

223 
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FIGURE 8.1 

Example of encoding a visual cryptography scheme. 


1. lajfcMmu-r 

2. For each G (f T the restriction of all matrices in 9JI?, to the rows 
indexed by i £ G gives the same multiset of \G\ X n matrices as 
the restriction of all matrices in 9Jl u , to the rows indexed by i £ G. 
(This formalizes the requirement that an unqualified set of persons 
gain no information about the secret.) 

3. G £ r is a minimal qualified set if every proper subset G' C G 
is not an element ofT. 

For each minimal qualified set of persons G the restriction of a 
matrix in to the rows indexed by i £ G give a |G'| x m matrix 
with at least h(G) nonzero columns and the restriction of a matrix 
in to the rows indexed by i £ G give a |G| x m matrix with 
at least 1(G) nonzero columns. The inequality h(G) > 1(G) must be 
satisfied. (This formalizes the idea that we see a black pixel as a 
darker gray than a white pixel.) 

Note: The condition (a) can be relaxed a bit, we choose |9Jlt| = |91t u , | for 
simplicity. Some authors require that condition (c) holds for all qualified sets 
GgF not only for the minimal qualified sets. 

The performance of visual cryptography scheme is described by 3 para- 
meters. 

• The randomness r, that measures the amount of entropy needed to encode 
an image. 

• The number of subpixels m need to encode an pixel (pixel expansion). 

• The contrast a = min{(/i(G) — 1(G)) / m\G £ F } that measures the quality 
of the reconstructed image. 

In applications the contrast is the most important factor. (Anything below 
1/10 can be hardly used if you really stack transparencies.) Thus, finding 
contrast optimal schemes is an important task. 

The goal of this chapter is to prove upper bounds on the possible contrast 
and to construct schemes near that bounds. 
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8.2 Preliminaries 

For the moment we will ignore the pixel expansion and the randomness. Then 
contrast optimal visual cryptography schemes can be simplified. 

Lemma 1 Let T be any access structure then there exists a contrast optimal 
visual cryptography scheme (3J lw, 9 71b) for T with the property that Wlw is the 
multiset of all column permutations of a matrix M\y and 9 71b is the multiset 
of all column permutations of a matrix Mb- 

Proof 

Let (9 7l' w ,97l' B ) be a contrast optimal visual cryptography scheme for T with 
pixel expansion rn and randomness r. 

Let Mw = . . . ,M< w ( ' r ' > ) be the n x (mr) matrix which consist of 

all matrices M^ 1 ' £ ( i = 1 written in sequence, one after the 

other. Similarly let Mb be the n x (mr) matrix that consists of the matrices 
in 9 7l B written after each other. 

Let G r, by Definition 1 (b) the restriction of Mw and Mb to the rows 
i £ r must give return two matrices that different only for a permutation of 
their columns, i.e., the scheme (WIw,9JIb) satisfies the security requirement 
(Definition 1 (b)). 

Now let G £ r by Definition 1 (c) the restriction of every matrix in 971b to 
the rows igT contains at least am more nonzero columns than the restriction 
of a matrix in 9 TXw to the same rows. Thus, the restriction of Mb to the rows 
i £ T contains at least amr more nonzero columns than the restriction of Mw 
to the rows ief That proves that the scheme (9 ’R w ,771b) reconstructs the 
secret image. □ 

The advantage of the scheme constructed by Lemma 1 is that the visual 
cryptography scheme is now described by just two Boolean matrices M' w and 
M’ b instead of two multisets of Boolean matrices. Moreover the order of the 
columns in M' w and M' B does not matter. For each S C {1, . . . ,n} let x 
denote the number of columns in M' w with 1 in the rows corresponding to 

( R) 

S and 0 in the other rows. Similarly define the variables x B . The scheme is 
described completely by the values x^\ x^\ 

The security requirements of the visual cryptography scheme translates to 
the linear equations 

= E^ B) ( 8A ) 

SC{l,...n} SC{l,...n} 

snG^o snG^o 

for all G £ r and the requirement that a qualified subset can see the image 
translates to 

E*E < E^ B) ( 8 - 2 ) 

SC{l,...n) SC{l,...n} 

snG^o snG^o 


© 2012 by Taylor & Francis Group, LLC 



226 


Visual Cryptography and Secret Image Sharing 


for all minimal qualified subsets G. 

The equations (8.1) and (8.2) lead to the linear program. Replace (8.1) by 

^ E x « B) 

SC{l,...n) SC{l,...n} 

snr/o snT^o 

and require 

5>S B) = 5>r> = 1 

SC{l,...n} SC{l,...n} 

and maximize a. For small values of n it is no problem to feed that program 
into a computer and get the optimal visual cryptography scheme. (I pre- 
pared such a program for my book [11]. You can download it from my home- 
page http : //cage .ugent . be/~klein/vis- crypt /buch/). 

For the fc-out-of-n access structure it is possible to simplify the linear 
program and solve it directly. 

Lemma 2 Let T be the k-out-of-n access structure. Then in addition to 
Lemma 1 we can require that any row permutation of Mw is also a column 
permutation of Mw and, similarly, every row permutation of Mb is also a 
column permutation of Mb- 


Proof 

Let Mw and Mb be the two Boolean matrices that describe the visual cryp- 
tography scheme constructed in Lemma 1. 

For every row permutation a the matrices M and M ^ also describe a 
fc-out-of-n visual cryptography scheme. 

Let Mw be the n x (mn!) matrix that consists of all row permutations 
Myy of M w written after each other. Similarly define Mb- As we have seen 
already in the proof of Lemma 1 this also gives a solution of the fc-out-of-n 
visual cryptography scheme. In addition Mw and Mb satisfy the permutation 
invariance stated in the Lemma. □ 


Lemma 2 allows us to simplify the linear program for a contrast optimal 
fc-out-of-n visual cryptography scheme. With the notations from above we 


get x ^ 
JB) 


= x{ B) and x™ 


A B ) 


= £ and x 


S 

(W) 


AW) 


AW) 
c {i 

The linear program simplifies to: 


for |S| = |S"|. Let for i £ {0, ...,n} be 




(8.3) 


This equation express that the variables denotes the fractions of black sub- 
pixels and that all fractions add up to 1. 


n-j 

E 

2=0 


n ~ J \ X {W) 


n-j 

= E 

i=0 


n ~3\ x W 


(8.4) 
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for j = 0, . . . , k — 1. This equation expresses that the stack of j transparencies 
always has the same number of white subpixels and replaces (8.1). 

Maximize 


a = 




(8.5) 


In this form the linear program is simple enough to solve it directly. We 
will track this problem in Sections 8.5 and 8.6. 

The linear program has been independently deduced by several researchers. 
(Variable transformations like x[ W ^ or x\ W ^ = (^x^l are common. 

This makes the results look quite different in various articles. Always check 
the meaning of the variables.) 


8.3 Approximate Inclusion Exclusion 

The well-known inclusion-exclusion-formula states. 


\A l uA a U...UA n \ = '£\A i \-'£\A i nA j \+ 

i i<j 

J2 \ A i n Aj n A fe | - . . . - (-i)"|Ai n...n4| ■ 

i<j<k 

Obviously, every term on the right-hand side is needed to determine the size 
of the union. At this point we can ask whether it is possible to give an ap- 
proximate inclusion-exclusion formula. More formally we ask: 

Given integers m , n with m < n and sets Ai , . . . , A n and B i , . . . , B n where 
not all Bi are empty and where 


n a ‘ 


n* 

ies 


for every subset S C {1, ... ,71} such that [S'] < m, what is the smallest (or 
largest) possible value for the fraction 

|A 1 U...UA»| ? 

\Bi U . . . U B n \ ’ 

The problem of approximate inclusion-exclusion is closely related to con- 
trast bounds in visual cryptography schemes. For n-out-of-n and (n— l)-out-of- 
n scheme the solution of the approximate inclusion-exclusion problem trans- 
lates directly to a contrast optimal visual cryptography scheme (see Theo- 
rem 4 for the details of the translation) . Other applications of the approximate 
inclusion-exclusion are constant depth circuits and Boolean functions [15]. 
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It is convenient to replace the size of the sets in the approximated inclusion 
exclusion problem by arbitrary measures to get a continuous problem. This 
leads to the following problem. Let be a measurable space and let 

A\,...,A n and B \ , . . . , B n be measurable sets with 



for every subset S C {1, ... ,71} such that | < to, what is the smallest (or 
largest) possible value for the fraction 

U . . . U AQ 
KBi U . . . U B n )‘ 

Similarly to Lemma 1 we can restrict the approximate inclusion-exclusion 
problem to symmetric collections. With 

D n H Aj ] ~ ^ 

Ses j$s ' 

for \S\ = i the approximate inclusion-exclusion problem leads to the linear 
program 

n 

^ Z X i ( 8 ' 6 ) 

i = 1 


= 0 for 1 < j < m (8.7) 

— E/ Xi — f° r a ^‘ 8 ' — {!)•■■; n l • (8-8) 

ieS 

(See [15] Lemma 3 for a proof). 

Dualizing the linear program leads to the following problem of approxima- 
tion theory (see [15] Lemma 5 and Section 8.6 where we use that technique 
to determine the asymptotic behavior of fc-out-of-n schemes). 

Determine 

inf max 1 — q(x) (8.9) 

q x=l,...,n 

where the infimum ranges over all polynomials q of less than m that have zero 
constant terms and satisfies q{x) < 1 for all x € {1, . . . , n}. 

The special case to = n leads to Krawtchuck polynomials (see [15] The- 
orem 3). But for this special case a elementary combinatorial proof exists 
(see [12]). 


subject to: 


Maximize: 


E 


£5 ^ 


-1 
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Theorem 3 Let A ±, . . . , A n and Si, , B n he two collections of sets satisfy- 
ing 


n A ‘ 

ies 


ns. 

ies 


for all proper subsets S of {1, ... ,n}. Then 


UILi b. 

- U: 

n A 

i=i ^ 


U; 

n td 

i=l 



The bound is sharp. 


Proof 

We prove by induction on n that the conditions 


n Al 


n s < 


for all S C {1, . . . , n} and the condition 


u* 

i=l 


+ k 


U B, 

i = 1 


with k > 0 imply that 


U 

i=i 


B, 


> k.2 


n— 1 


For n = 1 this is trivial. Now suppose that the theorem holds for n and 
let the sets A±, . . . , A n+ i and Si, ... , S n+ i satisfy 


n a ‘ 


n s < 


for all S C {1, . . . , n + 1} and 


n+1 

u 


A, 


n+1 

u B < 


i= 1 


The collections A! i = Af\A n+ \ and S' = S,;\S„ +1 satisfy | U”=i + 1 + ^ = 
| Ur=i + an d f° r every proper subset S C {1, . . . , n} we have 


rv; 

ies 

= 

( — rjJ 
C— .<£ 

- 

P| - l / n A n + i 

ies 




= 

n«* 

ies 

- 

P| Bi n S n+ 1 
ies 

= 

r>; 

ieS 
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Thus the collections A\, J3' satisfy the induction hypothesis, i.e. , we have 

I U?=1 ^<1 > *2”- 1 . 

On the other hand, we have the collections A" = A.i fl A n+ 1 and B " = 
Bi n B n+ 1 . Since 

n n 

U A * = U B i 

i= 1 i= 1 

n n 

114 + U- 4 " = + U B " 

2—1 2=1 2=1 2=1 

and | Ur=i A 'i\ + ^ = | Ur=i -®il we find that the collections A" and B" satisfy 
the induction hypothesis with | |J” =1 B"\ + k = lU^i^l- Thus, \B n+ i\ = 
\A n +i\ > IUILi A i\ - k2 n ~ 1 . This proves 

n+1 n 

|j Bi = (J B{ + \B n+1 \ > k2 n ~ 1 + k2 n ~ 1 = k2 n 
2=1 2=1 

as desired. 

To see that the bound is sharp consider the sets 

Ai = {5 C {1, . . . ,n} | \S\ even, i e S} 

and 

Bi = {Sc {1, . . > ,n} | |S| odd , i e S} . 

Since for each nonempty set the number of subsets of even cardinality is the 
same as the number subsets of odd cardinality (0 = (1 — l) n = Xq=o( — 1) J (”)) 
we get 

= f| S ‘ =2"-' s l- 1 

ies ies 

for each proper subset S' of {1, , n}. Hence, the sets A t and Bi satisfies the 
requirement conditions of the approximate inclusion-exclusion problem and 

|u?=i s i| - \{J?=i A i\ _ 2 n ~ 1 — (2 n_1 — 1) _ 1 

|U" = i-Bi| 2 n ~ 1 ~ 2"- 1 ’ 

i.e., the bound given by the Theorem is sharp. □ 

Theorem 3 translates directly to an contrast optimal n-out-of-n visual 
cryptography scheme. 

Theorem 4 (see [16]) The optimal contrast of a n-out-of-n visual cryptog- 
raphy scheme is a = 2 1 ~ n and the minimal pixel- expansion is m = 2 n ~ 1 . 

Proof 

By Lemma 1 a n-out-of-n visual cryptography scheme can be described by 
two Boolean matrices Mw and Mg. 
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Interpret the row vectors of M \y and Mb as incidence vectors of the sets 
A{ and It, . 

The security requirement ((b) in Defintion 1) says lUieS^il = IUies-®*l 
for all proper subsets S of {1, . . . , n}. By the inclusion-exclusion formula this 
is equivalent to I Hies Ai\ = | Dies B i | for all proper subsets S of {1, ... , n}. 
By Theorem 3 we have 


a = 


ur=i^ 

- 

U 

n A ■ 

i = 1 


u; 

n p 

i = 1 ^ 



< 2 1_ ™ . 


Vice versa the incidence vectors of sets solving the approximated inclusion- 
exclusion problem define a contrast optimal n-out-of-n visual cryptography 
scheme. Note that 1/a is also a lower bound for the pixel expansion m and 
the example shows that this bound is sharp. □ 

Using the proof technique of Theorem 3 one could also solve the approxi- 
mate inclusion-exclusion problem for the case that only the size intersections 
of up to n — 2 sets are known. 

Result 5 (see [12] Theorem 3.6) Let A±, . . . , A n and Bi, . . . , B n be two 

collections of sets satisfying 


n Ai 


n* 


for all proper subsets S of {1, ... ,n} with IS) < n — 2. Then 


UIU B i 


> i - 



The bound is sharp. 

For the proof see [12]. At this point we show only the construction that 
proves the sharpness. 

We give for every subset S C {1, . . . , n} the size 


PI A A U 

ieS i(£S 


and 


n b a u ,i ' 

i$S 


ies 


The construction is best understood if we look at the example n = 9 first. 


\S\ 

1 

2 

3 

4 

5 

6 

7 

8 

9 

flies Uif/s 

TP 

3 

0 

~T 

0 

IT 

T" 

0 

4 

flies B i\ Ui^S B i\ 

4 

0 

2 

~0~ 

0 

1 

“O' 

3 

0 
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In general we will have a zigzag line of numbers starting on the left side 
in the B - row with the value going down to 1, then has one gap and 

restart with 1. The general rule is as follows: 


PI U 

ieS i<£S 

n b a u ii ‘ 

ies i^s 


\S\- 

-rti 

if 

\s\ 

> 

n/2, and 

\s\ 

is 

odd 

rn- 

-\S\ 

if 

|S| 

< 

n/2, and 

|S| 

is 

even 

0 


in 

all 

other cases 




\S\- 

■rti 

if 

\s\ 

> 

n/2, and 

\s\ 

is 

even 

rt i - 

-\S\ 

if 

|5| 

< 

n/2, and 

|5| 

is 

odd 


0 in all other cases 


(8.10) 


( 8 . 11 ) 


Some elementary combinatorial calculations ([12] Theorem 3.8) show that 
this example satisfies Result 5 with equality. 

Similar to Theorem 4 we can use Result 5 to prove that the contrast a of 
the optimal (n— l)-out-of-n visual cryptography scheme satisfies a < . n 2 _! . . 

n ( L H^ij) 

The example given above can be used to construct a scheme that satisfies the 
bound with equality (see [12] Theorem 3.10). 


8.4 Designs and Codes 

2-out-of-n. visual cryptography schemes are a very special case. In a symmetric, 
contrast optimal scheme we encode a white pixel by giving all participants 
the same share. For a black pixel we want to minimize the overlap of black 
subpixels on the transparencies. This is a typical coding theory problem. 

The link to coding theory becomes clear by comparing the following two 
theorems and their proofs. 


Theorem 6 (Plotkin bound) A 

tance d > has at most 2 I 2d /_ n I 


binary code of length n with minimal dis- 
codewords. 


Proof 

Let m be the number of codewords. Let A = Ylc^c' ^( c > c 0 where the sum 
ranges over all pairs of codewords. Since the code has minimal distance d the 
sum is bounded below by ( T ”jci. 

Let rrij be the number of codewords that have 1 in the zth column. The 
contribution of those columns to the total distance A is to,; (to — mf) < 
|_m/2j [to/2] . 

Hence, \_m./2\ [to/2] > A > \ m(m — l)d. For d > \n this gives the bound 
stated by the Theorem. □ 
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Theorem 7 ([3] Theorem 4.2) The contrast a of an 2-out-of-n visual 
cryptography scheme is bounded by 

< \n/2] [n/2\ = f for n even 

a ~ n (n — 1) for n odd 

Proof 

Let m be the number of subpixels and a be the contrast. When stacking 
transparencies the fraction of black subpixels cannot become smaller. Thus, 
the number of black subpixels on each transparencies must be increased at 
least by am, i.e. for every transparency t\ and every transparency 1 2 there 
must be at least am subpixels that are write on t\ and black on f 2 . All pairs 
of transparencies give, therefore, at least n(n — 1 )am black-white subpixel 
combinations. 

Now look at the number of black-white combinations that come from a 
single subpixel. If the subpixel is white on i transparencies and black on 
n — i transparencies it contributes i(n — i) black- white combinations. The 
term i(n — 1) is bounded by \n/2\ \n/ 2] . 

This lead to the inequality 

n(n — 1 )am < [n/ 2J |~n/2]m . 

Solving the inequality gives the theorem. □ 

The bound of Theorem 7 is sharp and the contrast optimal 2-out-of-n 
schemes are related to designs. Let’s recall the definition of a 2 — ( v , k, A) 
design. (I recommend [1] as a reference for design theory.) 

Definition 2 A 2 — (v,k, A) design is a an incidence structure ( V,B,I ) with 

• |V| = v points 

• Every block B £ B is incident with k points. 

• Every pair of points p,q £V is joined by exactly A blocks. 

Theorem 8 (see [3] Theorem 4.4) Let n be even. A 2-out-of-n visual 
cryptography scheme with optimal contrast a = and pixel expansion m 
exists if and only if there exists # 2 - (n, |, ~ - ) design. 

Proof 

If we have equality in Theorem 7 we must have equality in every step. 

Thus, for each two transparencies there are exactly am subpixels that are 
white on the first and black on the second transparency. Furthermore, each 
subpixel is black on exactly n/2 transparencies. 

Let Mb be the Boolean matrix that describes the encoding of a black pixel. 
Interpret Mb as an incidence matrix of incidence structure (V, B, I) (Columns 
of Mb corresponds to block and rows of Mb to points.) 
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As we have seen above every block consists of ^ points. 

Since for every two transparencies the number of subpixels that is white on 
the first and black on the second is constant. Each transparency must have the 
same number of black subpixels. Since each subpixel is black on exactly half 
of the transparencies the number of black subpixels per transparency must be 

m 
2 * 

Thus, two transparencies have exactly r f — am = common black 

subpixels. In the interpretation as incidence structure: Each two points are 
joined by blocks. 

In other words Mb is the incidence matrix of a 2 — (n, ) design. 

Conversely the incidence matrix of a 2 — (n, design satisfies all 

requirements of a 2-out-of-?r visual cryptography scheme. □ 

Similarly, we can deal with the case of n odd. The Proof of Theorem 7 
shows that every column in Mg must contain either \n/2\ or |~n/2] zero 
entries. So we do not get a design (every block is of the same size), but a 
structure called pairwise balanced design (PDB) where the size of block may 
vary between some values. We skip the details and just state the final result. 

Result 9 (see [3] Theorem 4.5) Let n be odd. A 2-out-of-n visual cryptog- 
raphy scheme with optimal contrast a = 4 ^_ 4 and pixel expansion m exists 

if and only if there exists a 2 — (n, w — m ^ 4r ) l ~ 1 ' > ) PBD such that 

every point lies in exactly w blocks, where w is an integer in the range 

(n — l)m (n + 1 )m 

2 n ~ ~ 2 n 

A well-known result from coding theory states that Hadamard codes 
archive equality in the Plotkin bound. So we are not surprised that Hadamard 
matrices can also be used to construct optimal 2-out-of-n visual cryptography 
schemes. 

Recall the Definition of Hadamard matrices. 

Definition 3 A Hadamard matrix is a n x n matrix H with entries ±1 and 
HH l = nl. 

It is well known that except for n = 1, 2 the order of a Hadamard matrix 
must be divisible by 4. The famous Hadamard conjecture states that for every 
n a (4n) x (4n) Hadamard matrix exists. See [8] for an overview of constructions 
of Hadamard matrices. 

The connection to visual cryptography is established by the next theorem. 

Theorem 10 (see [3] Theorem 4.7) The pixel expansion of a contrast op- 
timal 2-out-of-(An — 1) visual cryptography scheme is at least m > 4n — 1. A 
scheme with m = An — 1 is equivalent to the existence of a 2 — (4n — 1, 2n — 
l,n— 1) design (called a Hadamard design,). This is equivalent to the existence 
of a Hadamard matrix of order An. 
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Proof 

Let Mb be the matrix describing the encoding of a black pixel. As in the proof 
of Theorem 8 we find that each transparency must have the same number w 
of black subpixels and each two transparencies must share the same number 
A < w of black subpixels. Interpret Mb as an integer matrix, then 

M B Mg = (w- A)/ + A J . 

This matrix has a full rank (det(u; — X)I + XJ = (w — X) n ~ 1 (nX — X + w)) and 
hence, 

4n — 1 = rank M B M B < rank M b < to . 

(This is the Fisher’s inequality.) 

Now assume m = 4n — 3 then w must be either 2n — 1 or 2 n. In the 
first case every column of M w must contain 2 n — 1 entries 1 and M w is the 
incidence matrix of a 2 — (4n— 1, 2n — 1, n — 1) design. In the second case every 
column of Mw must contain 2 n entries 1 and Mw is the incidence matrix of 
a 2 — (An — 1, 2 n, n) design. But then the complement of Mw is the incidence 
matrix of a 2 — (An — l,2n — l,n — 1) design. This shows that a contrast 
optimal 2-out-of-(4n — 1) visual cryptography scheme with pixel expansion 
to = An — 3 implies the existence of a 2 — (An — l,2n — 1 , n — 1) design. 
But conversely you get a 2-out-of-(4?r — 1) visual cryptography scheme from 
a 2 — (An — l,2n — l,n — 1) design by defining M B to be the incidence matrix 
of the design and encode it with a pixel by choosing on all transparencies the 
same subpixels. 

Now we prove that the existence of 2 — (An — l,2n — l,n — 1) design is 
equivalent to the existence of a Hadamard matrix of order An. 

Multiplying a row or a column of a Hadamard matrix with —1 again gives 
a Hadamard matrix. So without loss of generality we may assume that the 
first row and the first column of a Hadamard matrix has only 1 as entries. Let 
H be a Hadamard matrix of order An in that normal from. All rows except 
the first row of H must contain 2 n entries —1 and for two rows different rows 
must differ in exactly 2 n columns. Hence, after deleting the first row and first 
column H forms the incidence matrix of a 2 — (4n — 1, 2 n — 1, n — 1) design 
(with —1 instead of 0 to mark that a point is not incident with a block). 
Conversely the incidence matrix of a 2 — (An —1,2 n — 1 ,n — 1) becomes a 
Hadamard matrix, if one replaces all 0 by —1 and adds an extra column and 
an extra row that contains only 1. □ 

Other 2-out-of-n visual cryptography schemes are also connected to 
Hadamard matrices. 

Result 11 (see [3] Theorem 4.9) The minimal pixel expansion m of con- 
trast optimal 2-out-of-n visual cryptography schemes satisfies: 

{ 2 n — 2 if n even 
n if n = 3 mod 4 

2 n if n = 1 mod 4 
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If the Hadamard conjecture is true the bounds are sharp. 

We remark that there are 2-out-of-n visual cryptography schemes with 
smaller pixel-expansion that are not contrast optimal. In [3] (Theorem 4.12) 
2-out-of-?i visual cryptography schemes with pixel expansion in ss yfn and 
contrast a « \ are constructed. For n = (, ”J 2 j) there exists a 2-out-of-n 
visual cryptography scheme with pixel expansion m and contrast 1/m (just 
color on each transparency is a different set of |_77Z / 2 J subpixels). This is the 
minimal possible pixel expansion. 


8.5 Optimal 3-out-of-n Schemes 

We construct a scheme that has the normal form of Lemma 2. Remember that 
we denoted by xi W ^ the number of subpixels when encoding a white pixel 
that are black of the slides 1 ,i and white on the other slides. Similarly 

/ D\ 

x\ ' describes the encoding rule for a black pixel. As we have seen in the 
introduction, a fc-out-of-?r scheme must satisfy 


and 


am = 




E 


2 = 0 


n - j\ jw) _ 

. i r 


E 


2=0 



(8.12) 


(8.13) 


for j = 0, . . . , k — 1. 

Let S(3,g,n) be the visual cryptography scheme that is described by the 
values ccl 14 ^ = x ^ = ( ra_1 ) — ("“j), x^jl = Xg B ' = 1 and all other variables 

\ q / \ q l / y 

are 0. 


Theorem 12 ([2] Theorem 4.6) S(3,g,n) is a 3-out-of-n visual cryptogra- 
phy scheme with pixel expansion m = 2( n “ 1 ) and contrast 

9in- 2 g) 

rv = . 

2 (n — 1 )(n — 2) 


Proof 

For j = 0 we have in (8.13): 



For j = 1 we get 
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which is also true, since (”_ ) = For j = 2 we get 





• 1 


which is true since ("- 1 ) - QlJ) = (^) and (»; 2 ) + £$ = ("-*) + QZ?) 

(V)- 


Thus, S(3,g,n) satisfies the security requirements of an 3-out-of-n visual 
cryptography scheme. 

The contrast of S(3,g,n) is 


n — 3 
0 

n — 2 
5 

n — 3 
5-1 
n — 3 
5-1 


n — 1 
5 

n — 2 
5-1 
n — 2 
5-3 
n — 3 
5-2 


n — 1 
5-1 
n — 1 
5-1 
n — 3 
5-3 


n — 3\ i /n — 3 
n -gJ V 5 
n — 3\ /n — 3 

5 — 3/ _ V 3 


So the image is indeed recovered. □ 

The scheme S(3,g,n) archives optimal contrast if we choose g = Lt^J- 
This is the best possible contrast for a 3-out-of-n scheme. To prove this result 
we introduce the canonical form of a fc-out-of-n scheme. 

Remember that a fc-out-of-n scheme is described by the following linear 
program. 

Maximize: 


a = 




Subject to 


and 



for j = 0, . . . , k — 1. 


(8.14) 

(8.15) 

(8.16) 


Lemma 13 There is an optimal solution of the linear program defined by 
(8.14), (8.15), and (8.16) that satisfies: 

Ilf k is even, then and x[ B ^ for i = 0, . . . , n. 
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2.1f k is odd, then x = x^ t for i = Q,...,n. 

3x\ W ^ x^ = 0 for all i £ {0, . . . ,n}. 

We will say the solution of the linear program is in a canonical form. 


Proof 

We first show that replacing each transparency of a /c-out-of-?r visual cryptog- 
raphy scheme by its complement again gives a solution of a k-out-ol-n visual 
cryptography scheme. In the language of linear programming: 

Let x^\ x^ 3 ' 1 be a solution of the linear program (8.14)-(8.16). We claim 
that 

if k is even 
if k is odd 


x™ = 


and 


x^ = 


' (B) , . 

x n _ i n k is even 
AW) 


is also a solution of the linear program. 

Since (") = (^(E) the variables x[ W ^m x[ B ^ satisfy (8.16). 
We claim that equation 8.16 implies 


n-j 


e : 




n-j 


) X 

i = 0 x ” i - 0 


-e 


n -3\ x W 


for all h < j. For j = 0 this is trivial and for j > 1, h > 1 it follows from 

-3+ V 

-h+l) 


GLfc) = (?-/£i) - (i-hli) b y induction 


and 


n— j , „ x n—i 

f n ~ J + jyv) 

^ \ i — h + 1 


i = 0 


i = 0 


e ?: 


n - j + A _(B) 

i-h + i) i 


E 


n-j 

i — h+l 


AW) 


! x i ' = E 

i = 0 1 ' j=0 

To simplify the notation let us assume in the following that k is even. 


n — j 

i — h+l 


{B) 
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When k is odd, it is necessary to exchange 1 by x\ B ^ and vice versa. 


E 

2—0 


U ~ J \x (W) - 


= E 

2 — 0 
n 

= E 

2=7 

n 

= E 

%=j 

n 

= E 

i=j 

n-j 

= E 

2 = 0 


i.e. , the variables a^^m satisfy (8.16). 
By the same argument we get 


n ~ J \ x {W) . 


n ~ i 


n ~J\ x m 


i-J 


n ~3\ x i B ) 


i~3 


n ~ J \ X {B) 


2—k 


2 = 0 


n — k 


e or; )*!” + <-u‘° =£(;: 


2— /c 


2 = 0 


n — k 


iw) 


(8.17) 


for ft. < fc. 

For h = k this shows that "* m is an optimal solution of the linear 
program. 

Let x\ W \ x\ B \ and x^ B ' 1 be two solutions of the linear program, then 
x^ V ' > = ^{x[ W ^ + x ( j W ' 1 ), x[ BS> = \{x^ + x[ B ' 1 ) is also a solution of the linear 
program. 

After this transformations we have a solution that satisfies (a) and (b). 

Assume that we have a scheme that does not satisfy (c), i.e., the matri- 
ces Mw and Mb have columns in common. Since the corresponding subpix- 
els occur independent of the encoded color they can be omitted. Deleting all 
columns that occur in Myy and Mb we get a scheme with smaller pixel expan- 
sion and higher contrast. That proves that every optimal fc-out-of-?i scheme 
must satisfy (c). □ 

Now we are ready to determine the optimal contrast of a 3-out-of-n visual 
cryptography scheme. 


Theorem 14 ([2] Theorem 4.7) The contrast a of a 3-out-ofm visual 
cryptography scheme satisfies 


a < 


(n-2L^J)L^j 

2 (n — l)(n — 2) 
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Proof 

Assume that the scheme is in canonical form (see Lemma 13) and let M \y and 
Mb be the n x m Boolean matrices that describe the encoding. 

Since the scheme is in canonical form, m is even and exactly m! = y 
subpixels on each slide are black. In terms of the linear program this means 



(8.18) 


By equation 8.17 (with ft = 1) the contrast a is 


n—k , „ 

E l n — 3 
1 i- 1 


, X B ) 


n—k 


I Tl — 3 
~~ ^ \ i - 1 


JW) 


i= 0 x y i= 0 

Since the scheme is in canonical form we have x^ ^ and hence, 



Now use equation (8.18) to multiply with 1 and we get 


E n 

i = 0 * 


SB) 


a = 


((”:?) 


/n-3> 
V i— 2 ) 


2Er=o- 


(B) (n-l\ 


The inequality < maxj holds for any functions / and g. Hence, 


g(x 


a < 


max 

0<i<n 



The maximum is reached for i = which proves the theorem. □ 

In a recent article M. Bose and R. Mukerjee [5] show how to use group 
divisible designs and balanced incomplete block designs to construct 3-out-of-n 
visual cryptography schemes with optimal contrast and small pixel expansion. 
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8.6 Asymptotic Optimal k-out-oi-n Schemes 

In the previous sections we solved the problem of contrast optimal visual 
cryptography schemes exactly. The result for general fc-out-of-n is a little bit 
weaker; we have only a tight bound for the optimal contrast. 

We start with the linear program 
Maximize: 


a = 




S B ) 


Subject to: 




1 


and 


n—3 

E 

i=0 


n ~ J \ X {W) 


n-j 

= E 

i = 0 


n -3\ x W 


for j = 0, . . . , k — 1. The sign conditions are x . > 0, x[ B ' > > 0. 

For the following it is convenient to use the variable transform x\ W ^ = 
(l) x i W ^ aR d = (” )x j B K The linear program takes the form 
Maximize a = d (x^ w ' t — x^) subject to 


i=0 i= 0 

and 

A ^(W) _ ^ = Q 

where A is the k x (n + 1) matrix with entries A = (ayj) 

Note that the j - th row of A is the evaluation of a polynomial q 3 of degree j 
at the positions i = 0, . . . ,n. Similarly the vector c is the evaluation of k - th 
degree polynomial p(i) = ( n ^ k ) (”) at the places i = 0, . . . ,n. 

Now dualize the linear program. For each constraint we get a variable in 
the dual program and since all constraints of the primal program are equalities 
the variables in the dual program have no sign restriction. Each variable of the 
primal program gives a constraint in the dual program and since all variables 
have a sign condition we get inequalities as constraints in the dual program. 
The dual program is 
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Minimize s + t subject to 

A'u + (s, . . . , s) > c (8.19) 

-A'u+(t,..r)t)>c <==> A' - (t, ... ,t) < c (8.20) 

Equations (8.19) and (8.20) just state that 

s > max ( Ci — A'jU) 
t> max (A^u-Ci). 

In the optimal solution these inequalities must be equalities, i.e., 

s = max (c, — A'jU) (8-21) 

t= max (A^u — Ci). (8.22) 

Now we translate these equations into the language of polynomials. Re- 
member that Ci = p(i) for a fc-th degree polynomial and that the j-th row 
of A is the evaluation of a j-th degree polynomial qj. The polynomials qj 
(j = 0, . . . , k — 1) form a basis of the vector space Pk-i of all polynomials of 
a degree up to k — 1. 

So we may write the dual problem as: 

Determine 

a = min max (p(i) — q(i)) + max (q(i) — p(i)) ) • (8.23) 

q^Pk-i \i=0,...,n i=0,...,n J 

By adding the right constant to q , we can choose max,; = o,...,ra(p(*) — h(i)) = 
max, = o,... >ra (g(i) — which simplifies (8.23) to 

a= min max \p(i) — q(i)\ . (8.24) 

gGPfc-i i=0,...,n 

The low terms of p lie in Pk-i, so the problem is just to approximate the 
term of degree k. Since 



(n — i) ! (n — k ) ! 

(?r — i — fc) ! n! 

(n — i)(n — 1 — i) • • • (n — ( k — 1 ) — i) 
n(n — 1 ) • • • (n — (k — 1 )) 



the highest degree term of p(i) is (— 1 ) k /n-i k where n- = n(n— 1) • • • (n—k+ 1). 
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This simplifies (8.24) to 


a = 


min max 
q£Pk-i 



(8.25) 


Equation 8.25 is almost identical to the following classical problem in ap- 
proximation theory: 

min max \x k — q(x) I (8.26) 

q&p k - ia:e[-l,l] 

The only difference is that the approximation points in our problem are dis- 
crete. 

A well-known result from approximation theory states: 

Result 15 (see for example Theorem 5.7 of [18]) Of all monic polyno- 
mials of degree k the best approximation to 0 in [—1,1] with the ||. ||oo -norm 
is 2 1 ~ fe Tfc, where T^( x) = cos(fc arccos x) denotes the Chebychev polynomial of 
the first kind. 

Hence, the solution of (8.26) is 


q(x)=x k -2 1 ~ k T k (x) . 

The minimum in (8.26) is 2 k ~ 1 . Transforming it back to (8.25) we get an 
upper bound for a (only an upper bound since we switch from continuous 
evaluation points to discrete points.) 

Thus, we have the contrast a Ui k of a fc-out-of-n visual cryptography scheme 
is bounded by: 


Asymptotically continuous evaluation points and discrete evaluation points 
are the same, thus we have also 

/c 

lim < lim 4 1-fc ^ = 4^ fe . 

n — »oo n — »oo Tl— 

Obtaining a lower bound for a n need a bit extra work. We just cite 
without proof. 


Result 16 (see [14]) The contrast a n ^ of a contrast optimal k-out-of-n vi- 
sual secret sharing scheme satisfies 


4 k ~ l < a n h < 4 fc_1 - 


,k 
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8.7 Contrast Trade-Offs for Extended Visual 
Cryptography Schemes 

In this section we look at a visual cryptography scheme with extended ca- 
pacity. In [16] Naor and Shamir show that it is possible to create two trans- 
parencies such that each transparency shows an image and the stack of the 
two transparencies reveals another image. The three images must not satisfy 
any relation. 

In general, we have n slides and a subset 6 of V{{\, . . . , n})\{0}. For an 
©-extended visual cryptography scheme we require that for every S £ 6 the 
stack of the transparencies i £ S reveals an image Is- Furthermore, we require 
that there is no other way to get information about the image Is- 

As in the case of the simple visual cryptography schemes we formalize 
these ideas by describing the encoding algorithm by a multiset of Boolean 
matrices. This leads to Definition 4. 

Definition 4 Let 6 C V({1, . . . , n})\{0}. 

An &-extended visual cryptography scheme is described by multisets 9Jt~ 
of n x m Boolean matrices for X C 6. (For given 'X each Boolean matrix 
in Oil 1 describes the colors of the subpixels on each transparency, where the 
corresponding pixel in image It is black if and only if T £ X. For encoding, 
each matrix in is chosen with the same probability.) 

The multisets 9 7l~ must satisfy the following conditions: 

1. Let B £ fOb 1 . For {n, . . . ,i q } £ & the Hamming weight of the 
OR of the rows of B is h^ lt ... t i y if { i \ , • . . ,i q } £ X and 

otherwise, i.e., 


UJHam{,{bi 1 , 1 , 


,bi lt m ) OR ... OR (bi 1,. 


0 ) 


b{il ,...,iq } 
^{* 1 , — >*«} 


if {h, £ X 

if {h,...,i q } i X 


.2 


(This means stacking the transparencies i\,...,i q together we re- 
cover the image I{i lt ... t i }■) 

2. For {i\,...,i q } C {l,...,n} and X, X' C 6 with X (~1 
V({i \, . . . , i q }) = X 7 D . . . , i q }) we obtain the same multi- 

sets if we restrict the matrices in SH” 1 and 9JI” 1 , respectively, to the 
rows ii, . . . , i q . 

(This condition guarantees the security of the different images.) 

If 6 = V{{\, . . ■ , n})\{0} we simply call this an extended visual cryptography 
scheme. 
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©-extended schemes exists as the following theorem shows. 

Theorem 17 (see [9]) An &-extended schemes with pixel expansion 

m= 2lS1 ” 1 
see 

and contrast a = 1/m exists. 

Proof 

The ©-extended scheme is built from several k-out-oi-k schemes. For each 
S £ © we reserve 21 s !” 1 subpixels. On slides with number i ^ S these subpixels 
are colored black. For the slides i £ S these 2 I s ! -1 subpixels are used to 
construct an |S'|-out-of-|S'| visual cryptography scheme to encode the image 
Is (see Theorem 4 for the construction). 

To illustrate the construction let 6 = {{1, 2}, {1, 3}} then m = 4. The 
first two pixels are used to encode the image It in and the next two subpixels 
are for the image I{ 2 , 3 }- 

A typical matrix of 9Jt® is 

A o i i\ 

AT = 1 0 1 0 

A i i o/ 

and a typical matrix of SXJtB 1 ’ 2 }} is 

A o i i\ 

AT = 0 1 1 0 . 

\1 1 1 0 / 

In the upper right corner you see the 2-out-of-2 scheme for the image I{i, 2 }- 
We claim that this construction yields an ©-extended scheme. 

Let T C {1, . . . , n}, what happens if we stack the transparencies i £ T? 

In the 2l T l -1 subpixels associated with the image It we have |T|-out-of- 
|T| scheme and hence either all 2l T l -1 subpixels in the stack are black or only 
2l T A 1 — l subpixels are black depending on the color in the image It- 

For S ^ T and T % S we find an i £ T with i (/ S. On transparency 
i all 2l' s l~ 1 subpixels associated with I s are black. Hence, in the stack of 
the transparencies i £ T these 2l s l _1 subpixels are always black and do not 
contribute to the encoded color. 

For S yIT and T C S we have a |S'|-out-of-|S'| scheme for the image Is- By 
the security requirement stacking only the transparencies i £ T the number 
of black subpixels must be independent of the color of image Is- (There will 
be exactly 2l s l~ 1 — 2l s H T l~ 1 black subpixels associated with the image Is-) 
As we can see, only the 2l T l -1 subpixels associated with the image It 
contribute to the image that we see when stacking the transparencies i £ T . 
Hence, the stack of the transparencies i £ T reveals image It- 

Since the scheme is built from several standard fc-out-of-fc schemes, it in- 
herits the security from the standard visual cryptography scheme. □ 
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Similar to Lemma 1 we can restrict ourselves to the case that Tt~ is the 
multiset that consists of all column permutations of a matrix M % . 

For S C {1, . . . , n} we denote by Xg the number of columns of M % that 
have a 1 in the rows i € S and a zero in the rows i ^ S. The number of 
black subpixels in the image Ig is either hg (when a black pixel is encoded) or 
l s when a white pixel is encoded. Analog to the linear program for ordinary 
visual cryptography we get 


Mx % = r % (8.27) 

where r~ = (rg)q)jtsc{i,...,n} with rf = hg if S € T and r'g = lg if S ^ T. 

The (2 n — 1) x (2™ — 1) matrix M = {ms,T)^s,TC{i,...,n} is defined by 
ms,T = 1 if ST) T ^ 0 and ms,T = 0 otherwise. 

It possible to solve the program explicitly and the starting point is the 
observation that M has an simple inverse. 

Lemma 18 The matrix M = {ms,T)®^s,T<z{i,...,n} with ms , t = 1 ifSHT ^ 0 
and ms,T — 0 otherwise is invertible and AM 1 has only the entries ±1 and 0 . 

Proof 

We prove this by induction on the number n of transparencies. 

Sort the variables Xt by the following order: First, we enumerate all subsets 
that do not contain n. The next subset is the set {n}. Then, the other subsets 
containing n follow. 

Writing Mi = (1), we obtain the following recursion formula that follows 
directly from the definition: 


( M n 0„,i M n \ 

M n + 1 = I 0i,„ 1 ll,n I • 

\M n In, 1 1n,nJ 

Here the index denotes the number of transparencies. 0 , j or lij, respectively, 
denoting a (2* — 1) x (2 J — 1) matrix with all entries 0 or 1 , respectively. 
With Mi = (1) we obtain the following recursion formula for M ~ 1 : 

/ 0„, n -M~ l 1„,! M- 1 \ 

1 = I — li ,nM n 1 0 li^ n M n 1 I 

V M - 1 M-M nA -M- 1 ) 

Thus, M is invertible, i.e., Equation (8.27) has a unique solution. 

We notice that the components of are only —1, 0, and 1 and that 

= 1. Then the formula can be proved by induction. 

Thus, M~ 1 contains only the entries —1, 0, and 1 and therefore the solution 
of equation (8.27) is integral. □ 

By Lemma 18 the solution x % of equation (8.27) is an integer vector if the 
right-hand side r~ is an integer vector. 
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We can explicitly solve equation (8.27) by multiplying with M 1 and get: 


:|= ^ (_ 1 )|T| + |S|+ n +l r X 

{l,...,n}\SCTC{l,...,n} 


(8.28) 


To verify equation (8.28) we can plug in the values of x f in equation (8.27). 
The calculation is elementary and uses only the identity 



1 for n = 0 
0 for n > 0 


In a solution of an extended visual cryptography scheme every Xg must be 
nonnegative. This leads to 


Y (-1) |S1+|7 V? < 0 (8.29) 

scrc{l,...,n} 

for all possible subsets T of P({1, . . . , ?r})\{0}. 

In left-hand side of inequality (8.29) we have the sum over rx for |S| + |T| 
even and over —rx for |<S'| + |T| odd. This becomes maximal if all tt with 
|5| + \T\ even are as large as possible (i.e., equal hr) and all r t with |S| + \T\ 
odd are as small as possible (i.e., equal lx)- 

Thus, an extended visual cryptography scheme exists if and only if 

'y [ li'i < y ( It (8.30) 

SCTC{l,...,n} SCTC{l,...,n} 

|S| = |T| mod 2 |S|^|T| mod 2 

holds for each S C {1, . . . , n}. 

The linear program given by equation (8.30) is very simple and can be 
solved directly. 

Theorem 19 ([13] Theorem 3.4) An extended visual cryptography scheme 
with n transparencies needs at least |(3 n — 1) subpixels. Hence, the construc- 
tion of Theorem 17 is optimal with respect to the pixel expansion, i.e., 

M{V{{ l,...,n})\{0}) = i(3"-l) . 


Proof 

For each 0 ^ T C {1, . . . ,n}, let St = hx — It- Our goal is to prove that 
equation (8.30) implies 

m>h{ Y <5 r2 |Thl . (8.31) 

0#TC{l,...,n} 

As the first step in this proof we show that, for given values St (for 0 ^ 
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T C {l,...,n}), the number hii n \ is minimal if for all S C {l,...,n} 
inequality (8.30) is satisfied with equality. 

To this end, suppose 


hr < E 1t 

SCTC{l,...,n} SCTC{l r ..,n} 
|S| = |T| mod 2 |S|^|T| mod 2 


for some S C {1, . . . , n}. But the contrast levels 


hj 1 


hr for T C S 
hr — 1 otherwise 


and 


It — 



for T C S 
1 otherwise 


satisfy (8.30), since 


\{T | S C T C {1, , . . , n}; |T| = |5| mod 2}| = 

|{r|5CTC{l,..,,n};|T|^|5| mod 2}| . 

This proves that if inequality (8.30) is not satisfied with equality we can 
find smaller values for the parameters It and hr, which also satisfy (8.30). 
Thus, in an optimal scheme (i.e., a scheme with the smallest possible values for 
It and Ht) inequality (8.30) is satisfied with equality for each TC{l,...,n}. 
Next we claim that 


h T = E E $T'2 lT ' hl - m (8.32) 

0^T'C{l,...,n} TCT'C{l,...,n} 

for 0 ^ S C {1, . . . , n} satisfy (8.30) with equality. 

To prove this we have to show that 


E 


E 5 t ' 2 ' t ' I" 1 - E ^t' 2 |t ' i_1_|t| 


5CTC{l,...,n} L 0^T / C{l,...,n} TCT'C{l,...,n} 

|S| = |T| mod 2 


E 

SCTC{l,...,n} 
|S|^|T| mod 2 


E 5t> 2 |t 'I- 1 

1jfT'C{l n} 


E S T > 2' t 'I- 1 -I t I 

TCT'C{l,...,n} 
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E S T> 

0#T'C{l,...,n} 


SCTC{l,...,n} SCTCT' 

|S]=]T| mod 2 |S| = |T| ’‘mod 2 


-1-|T| 


E St ' 

<D^T' C{l,...,n} 


^ 2 i t 'i- 1 - Y 2' t 'i- 1 

scrc{l,...,n} SCTCT' 

|S|^|T| mod 2 |S|^|T| ’‘mod 2 


— 1 — |T| 


+6t‘ 


(_1)|T'| + |S| _ ]_ 


(Note that the last summand is equal to — 8t> for \T'\ ^ |5| mod 2 and equal 
to 0 otherwise.) 

Comparing coefficients for each St> we obtain 
2 n-|S|-l . 2 |T'| — 1 _ ^ 2 |T ' I ~ 1 ~ |T| = 


SCTCT' 

|S| = |T| “mod 2 


2 n-|S|-l . 2 in r l _ Y 2' T ' 


, (-D |T,|+|5| -1 


(8.33) 


SCTCT ' 
'|S|^|T| “mod 2 

but this is true since 

(^IT'HSI = (1 _ 2)I t 'I-|S| 

= |T g S| (\T’\ ~ |S| 

i = 0 

\r\-\s\ 


(-2Y 


i—0 \ 1 / i — o V 

i even i odd 


2* 


since 


Y 2 |T ' HT| - 

od 2 

\T’\ - \S\ 


SCTCT' 

|T'| = |T[ mod 2 


E 2lT ' 

SCTCT ' 
|T'|^|T| mod 2 

- E i- 

SCTCT' 

|T| — :|S|=i 


i-m 


Thus, 


Y 2 |T ' HT| = Y 2 |T ' HT| + (-1)I T 'HS1 


SCTCT' 

|T'| = |T| mod 2 


SCTCT ' 
'|T'|^|T| mod 2 
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and therefore, 


E 2 |T ' 

SCTCT' 

'|T'| = |T| "mod 2 


i-m 


+ 1 = 


E 

SCt3TCT' 

‘ |T'|=£|T| mod 2 


\~\T\ 


(-itIT'l + ISI . 


(Note that (— 1)I T I I s ! = (— 1)I T l + l s L) Division by 2 gives 


( 2' T 'l- 1 -l T | N j = ( 2 |T ' | - 1 ~ |T|N j I (~ 1 ) |T ^ +|S| - 1 

\ SCTCT' / \ SCTCT' ) 

|T']=]T| "mod 2 |T'|^|T| ""mod 2 

as required for equation (8.33). 

Suppose that Jit (for 0/TC{ 1, . . . , n}) satisfy (8.30) with equality, too. 
If inequality (8.30) is satisfied with equality for all subsets S, we can solve 
these equations recursively and get 

hs = h{ i, + Fs(5t | T C {1, . . . , n}) , 

for some function Fg. Since inequality (8.30) is satisfied with equality for the 
contrast values hr and h' T this yields 

hs = hs + h { - h{ 

But for S' = 0 inequality (8.30) yields h{i } ... >n \ = hs and therefore 
hr = hr for all 0 ^ T C {1, . . . , n}. 

This proves that (8.32) is the only solution of (8.30) that satisfies all 
inequalities with equality. 

Thus, we find 

m>h { E <5t' 2 |t ' I_1 > E 2 |T ' M = *(3" - 1) 
0#T'C{l,...,n} 0#T'd{l,...,n} 

what proves the theorem. □ 

Without proof we mention the following result about the contrast of the 
different images. 

Result 20 ([13] Theorem 3.6) For 0 ^ T C {1, . . . ,n} let cut = hT m T be 
the contrast of the image It- The contrast levels of the images satisfy 

E 2 |T|_1 a T < 1 • (8.34) 

0/TC{l n} 

Further, let a' T > 0 (for 0/TC{l,...,)j}) satisfy (8.34). Then for every 
e > 0 there exists a generalized visual cryptography scheme with contrast levels 
ctT (for 0 sf T C {1, . . . ,n}) where \ oit — cJ T | < e for all nonempty subsets T 
of n}- 
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The situation becomes more complicated if we no longer require that all 
combinations of transparencies reveal an image. The only case that is com- 
pletely solved is Result 21. 

Result 21 ([13] Theorem 4.4) Let 6 = ^({l, . . . , u})\{0, {1, . . . , n}} then 
the minimal pixel expansion m is given by 

{ |(3 n — 1) — 2 n_1 — 1 for n even 
j(3 n — 1) — 2 n_1 for n odd 


8.8 Enhancing the Contrast by Nonstandard Models 

All results in this chapter worked with the original model of visual cryptog- 
raphy as defined in [16]. In several papers extended models were discussed. 

Without going into details we mention: 

• In [19] the authors run an edge-detecting algorithm on the original image 
and use a higher number of subpixels on the edges for improved contrast. 

• Several authors studied colored visual cryptography (see [6, 17, 20, 7] and 
Chapter 7 of [11]). One can use additive and subtractive color mixing in 
combination to obtain good results. A possible variation of the classical 2- 
out-of-2 scheme replace the white and black subpixels by any two opposing 
colors. 


• It was also suggested to use polarization filters of different orientations to 
encrypt an image. 


• A interesting variation is the segment based visual cryptography [4]. For a 
7-segment display an image may be encoded as: 


• In [10] the authors note that the contrast definition a = of Naor and 
Shamir do not always fit the human intuition. They suggest variations like 
and show how to optimize visual cryptography schemes with respect to 
the new goal. 


8.9 Conclusion 

We constructed contrast optimal visual cryptography schemes for various ac- 
cess structures. The constructions exhibit links to different fields like linear 
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programming, approximation theory, the theory of error correcting codes, de- 
sign theory, and elementary combinatorics. 
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9.1 Introduction 

A visual cryptography scheme for a set of n participants is a method to en- 
code a secret image, consisting of black and white pixels, into n shadow im- 
ages called shares , one for each participant. Each share is a collection of black 
and white subpixels, which are printed in close proximity to each other, so 

255 
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that the human visual system averages their individual black/ white contribu- 
tions. The encoding is done in such a way that certain subsets of participants, 
called qualified sets, can ’’visually” recover the secret image, but other sub- 
sets of participants, called forbidden sets, cannot gain any information (in an 
information-theoretic sense) about the secret image by inspecting their shares. 
A ’’visual” recover for a set of qualified participants consists of xeroxing each 
share onto a separate transparency, of stacking together the transparencies 
and projecting the result with an overhead projector. If the transparencies 
are aligned carefully, then the participants will be able to see the secret image 
(without any knowledge of cryptography and without performing any crypto- 
graphic computation). 

This cryptographic paradigm was introduced by Naor and Shamir [11]. 
They analyzed the case of ( k , n)-threshold visual cryptography schemes, in 
which the qualified subsets of participants have cardinality k, whereas, the 
forbidden subsets of participants have cardinality less than k. Some results on 
(k, n)-threshold visual cryptography schemes (( k , n)-threshold visual cryptog- 
raphy scheme (VCS), for short) can be found in [1, 2, 5, 8, 10, 12]. The model 
by Naor and Shamir has been extended in [1] to general access structures (an 
access structure is a specification of all qualified and forbidden subsets of par- 
ticipants), where general techniques to construct visual cryptography schemes 
for any access structure have been proposed. 

Visual cryptography schemes are characterized by two parameters: The 
pixel expansion, corresponding to the number of subpixels contained in each 
share (transparency) and the contrast, which measures the ’’difference” be- 
tween a black and a white pixel in the reconstructed image. Visual cryp- 
tography schemes such that, in the reconstructed image, all the subpixels 
associated to a black pixel are black, are referred to as visual cryptography 
schemes with perfect reconstruction of black pixels. Such schemes have been 
considered in [12, 4, 3]. Unfortunately, it is not possible to obtain visual cryp- 
tography schemes with perfect reconstruction of both black and white pixels. 
Such schemes are said to have ideal contrast. 

In order to obtain perfect black visual cryptography schemes whose recon- 
struction of white pixels is almost perfect, Viet and Kurosawa [13] proposed 
a different kind of VCS, called VCS with reversing. Such VCSs require the in- 
troduction of an extra noncryptographic operation, that participants can use 
to reconstruct the image. Such an operation, which can be easily performed 
by many copy machines, is applied to a transparency and creates another 
transparency in which black pixels are reversed to white pixels and vice versa. 

Specifically, Viet and Kurosawa [13] proposed to run c times (with c arbi- 
trary constant) the distribution phase of a VCS with perfect reconstruction of 
black pixels and pixel expansion m, hence requiring each participant to store 
c • m subpixels for each pixel of the original image. The larger the number 
of runs c, the better the contrast of the resulting VCS with reversing. The 
drawback of such a solution is that the number of pixels in the reconstructed 
image, which depends on both the number of runs and on the pixel expansion 
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of the underlying VCS, is greater than that in the original secret image, i.e., 
there is a loss of resolution. 

Subsequently, Cimato, De Santis, Ferrara, and Masucci [6] showed how to 
construct VCSs with reversing where reconstruction of both black and white 
pixels is perfect. In particular, Cimato et al. [6] proposed two different con- 
structions. The first solution uses the fact that the introduction of the re- 
versing operation, in addition to the stacking operation, allows participants 
to compute any Boolean function of their transparencies, since these two op- 
erations, corresponding to NOT and OR, respectively, represent a complete 
basis for Boolean functions. In particular, the construction uses a binary se- 
cret sharing scheme and requires each participant to hold r transparencies, 
where r denotes the size of the largest share in the underlying secret sharing 
scheme. The second solution uses as a building block a VCS with perfect re- 
construction of black pixels, having a certain pixel expansion m and requires 
each participant to store m transparencies, each having the same number of 
pixels as the original image. Compared to the scheme of Viet and Kurosawa, 
such a scheme requires each participant to store m pixels instead than c-m, for 
each pixel of the original image, where c is the number of runs of the under- 
lying VCS needed in [13] to obtain an asymptotically ideal contrast. By using 
a sequence of stacking and reversing operations on their transparencies, in 
both schemes proposed by Cimato et al. [6] , each qualified set of participants 
recover the original secret image with no loss of resolution. 

Later, Hu and Tzeng [9] considered the problem of reducing the number 
of the transparencies held by each participant in VCSs with reversing. They 
proposed a construction for ideal contrast VCSs with reversing requiring each 
participant to store only two transparencies. In particular, the first one con- 
tains an encoding of the secret image, whereas, the second one is an auxiliary 
transparency needed for the reconstruction phase. However, the size of each 
transparency is |To| times larger than the size of the secret image, where |To| 
denotes the minimum number of subsets qualified to reconstruct the secret 
image. Indeed, each transparency contains |T 0 | blocks and each qualified sub- 
set of participants reconstructs, without loss of resolution, the secret image 
in a single block, whereas the other reconstructed blocks contain only white 
pixels. 

Then, Yang et al. [14] proposed two different constructions for ideal con- 
trast VCS with reversing. In particular, one of their schemes removes the need 
of using as a building block a VCS with perfect reconstruction of black pixels. 
However, there is a loss of resolution in both their schemes. 

Organization. In Section 9.2 we recall the definition and security require- 
ments of VCSs. In Section 9.3 we describe the almost ideal contrast VCS 
with reversing by Viet and Kurosawa. In Section 9.4 we show and compare 
some ideal contrast VCSs with reversing that use as a building block any per- 
fect black VCS. Finally, a VCS with reversing constructed upon any VCS is 
described in Section 9.4.3. 
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9.2 Visual Cryptography Schemes 

Let V = {1, . . . , n} be a set of elements called participants , and let 2 V denote 
the set of all subsets of V. Let rQ ua | C 2 V and Tporb C 2 V , where rQ ua inrForb = 
0. We refer to members of rQ ua | as qualified sets and we call members of 
L Forb forbidden sets. The pair (TQ ua |, Tporb) is called the access structure of 
the scheme. Define To to consist of all the minimal qualified sets: To = {X £ 
L Q ua [ : X' ^ r Qua , for all X' C X}. In the case where rQ ua | is monotone 
increasing, Tpor-h is monotone decreasing, and rQ ua | UTporb = 2 V , the access 
structure is said to be strong. In a strong access structure, rQ ua | = {C C 
V : B C C for some B £ r 0 }, and we say that TQ ua | is the closure of r 0 . A 
participant i £ V is an essential participant for (rQ ua |, Tporb) if there exists 
a set X C V such that X U {/} £ TQ ua | but X ^ rQ ua [. If a participant 
is not essential then we can construct a visual cryptography scheme giving 
him nothing as his share. In fact, a nonessential participant does not need to 
participate actively in the reconstruction of the image, since the information 
he has is not needed by any set in V in order to recover the secret image. 
Therefore, unless otherwise specified, we assume throughout this chapter that 
all participants are essential. 

The secret image consists of black and white 1 pixels. In order to share each 
pixel of the secret image the owner of the secret, usually called the dealer, 
provides each participant with a share (transparency), which is an enlarged 
version of the secret pixel consisting of a certain number m of subpixels, 
which are printed in close proximity to each other, so that the human visual 
system averages their individual black/ white contributions. Notice that the 
term ” subpixel” is misleading since a pixel is the smallest unit we can control 
on an image and thus we cannot further divide the pixel into subpixels. So 
the shared version of the original secret pixel will consist of m pixels, which 
are called subpixels because all together they represent the original secret 
pixel. The value m is called pixel expansion. The shares can be conveniently 
represented with an nxm matrix S where each row represents one share, i.e. , 
m subpixels, and each element is either 0, for a white subpixel, or 1 for a black 
subpixel. 

To reconstruct the secret image a group of participants stacks together 
their shares. The grey level of the combined share, obtained by stacking the 
transparencies i \, . . . , i s , is proportional to the Hamming weight w(V) of the 
m - vector V = OR(r , ... ,r if), where ry , . . . , rj s are the rows of S associated 
with the transparencies we stack. This grey level is interpreted by the visual 
system of the users as black or as white in accordance with some rule of 
contrast. Since each secret pixel is represented by rn pixels in the shares, 
the reconstructed image will be bigger than the original (depending on m 

1 Where white should really be interpreted as transparent. So we use white as a synonym 
for transparent. 
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and on the actual positions of the pixels, the image can also be distorted; 
a perfect square is a good choice for m because it avoids distortion). The 
characteristics of the model are encapsulated in the following definition, which 
is a generalization of the definition of (k, n)-threshold VCSs due to [12]. 

Definition 1 Let (rQ ua |,rForb) he an access structure on a set of n partici- 
pants. Two collections (multisets) of n x m Boolean matrices Co and C\ con- 
stitute a visual cryptography scheme (TQ ua |, rF or b)-VCS with pixel expansion 
m. if there exist two integers i and h such that h > t satisfying: 

1. Any (qualified) set X = {*i,i 2 , . . . ,i p } € TQ ua | can recover the 
shared image by stacking their transparencies. 

Formally, for any M £ Co, the ”or” V of rows ii, f 2 , . . . , i p satisfies 
Wh(V) < nr — h; whereas, for any M £ C\ it results that wjj(V ) > 
m — £. 

2. Any (forbidden) set X = {ip, z 2 , . . . , ip} £ Tporb has no informa- 
tion on the shared image. 

Formally, the two collections of p x m matrices V t , with t £ {0, 1}, 
obtained by restricting each n x m matrix in Ct to rows i\, z 2 , . . . , i p 
are indistinguishable in the sense that they contain the same matri- 
ces with the same frequencies. 

To share a white (black, resp.) pixel, the dealer randomly chooses one 
of the matrices in Cq (Ci , resp.), and distributes row i to participant i. The 
chosen matrix defines the m subpixels in each of the n transparencies. 

The first property of Definition 1 is related to the contrast of the image. 
It states that when a qualified set of participants stack their transparencies, 
they can correctly recover the image shared by the dealer. A pixel will be seen 
as a white pixel if sufficiently many subpixels (at least h) in the reconstructed 
image are white; whereas, it will be seen as a black one if not too many (at 
most l) are white. The value (h — £)/(h + £) is referred to as the contrast 
of the reconstructed image. Contrast gives a measurement of how clear the 
reconstructed image is in relation to the original one. The second property of 
Definition 1 is related to the security of the scheme, since it implies that, even 
by inspecting all their shares, any forbidden set of participants cannot gain 
any information in deciding whether the shared pixel was white or black. 

Several visual cryptography schemes have been realized by using two nxm 
matrices, S° and S 1 , called basis matrices. The collections Co and Ci are 
obtained by permuting the columns of the corresponding basis matrix ( S° for 
Co, and S' 1 for Ci) in all possible ways. This technique has been introduced in 
[ 11 ]- 

9.2.1 (k, /c)-Threshold Visual Cryptography Schemes 

In a ( k , /c)-threshold visual cryptography scheme the secret image is visible 
if and only if all k transparencies are stacked together, but totally invisible 
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if fewer than k transparencies are stacked together or analyzed by any other 
method. 

Naor and Shamir [11] proposed a construction for (fc, /^-threshold VCSs 
using two basis matrices S° and S 1 defined as follows: S° is the matrix whose 
columns are all the Boolean k- vectors having an even number of l’s, and 
S 1 is the matrix whose columns are all the Boolean fc-vectors having an odd 
number of l’s. The pixel expansion m of such a scheme is equal to 2 k ~ 1 and the 
relative difference (h — £) /m between reconstructed white and reconstructed 
black is equal to l/2 fc_1 . The above construction is optimal with respect to 
the pixel expansion and the relative difference between reconstructed white 
and reconstructed black. 

Example 1 The basis matrices S° and S 1 in a (4, 4) -threshold VCS are 


' 0 

0 

0 

0 

1 

1 

1 

1 ' 


' 0 

0 

0 

0 

1 

1 

1 

1 ' 

0 

0 

0 

1 

1 

0 

1 

1 

0 

0 

0 

1 

1 

0 

1 

1 


0 

0 

0 

1 

1 

0 

1 

1 

0 

0 

0 

1 

1 

0 

1 

1 

1 

o 

1 

1 

0 

1 

0 

0 

1 


1 

0 

0 

1 

0 

1 

1 

0 


The collections Co and C\ are obtained by permuting the columns of the corre- 
sponding basis matrix (S° for Co, and S 1 for C\) in all possible ways. In this 
scheme each pixel of the secret image is encoded into m = 8 subpixels. 

It is easy to see that the integers h = 1 and l = 0 satisfy Property 1 of 
Definition 1. Let S° be the matrix chosen by the dealer to share a white pixel; 
by stacking the transparencies held by all four participants we get the vector 
(0, 1, 1, 1, 1, 1, 1, 1, 1). On the other hand, let S 1 be the matrix chosen by the 
dealer to share a black pixel; by stacking the transparencies held by all four 
participants we get the vector (1, 1, 1, 1, 1, 1, 1, 1, 1). Property 2 of Definition 
1 can also be easily verified. Indeed, consider what happens when less than 
four participants stack their together transparencies. For example, consider 
the first three participants and notice that, by stacking their shares, we get the 
vector (0, 1, 1, 1, 1, 1, 1, 1, 1) in both cases when the shared pixel is either white 
or black. Thus, the participants are not able to distinguish the color of the 
shared pixel by inspecting their shares. 


9.2.2 Perfect Black Visual Cryptography Schemes 

Visual cryptography schemes such that, in the reconstructed image, all the 
subpixels associated with a black pixel are black, i.e., £ = 0, are referred 
either to as visual cryptography schemes with perfect reconstruction of black 
pixels or to as maximal contrast schemes. For example, the ( k , fc)-threshold 
VCS described in Section 9.2.1 has perfect reconstruction of black pixels. A 
perfect reconstruction of both black and white pixels, which would correspond 
to visual cryptography schemes having ideal contrast, is impossible. Indeed, 
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in [11] it has been shown that any [k, ^{-threshold VCS has a pixel expansion 
of at least 2 fc_1 and the relative difference (h — £)/m between reconstructed 
white and reconstructed black is at most l/2 fc_1 . This means that, in the 
reconstructed white pixel, for any 2 k ~ 1 subpixels, there is at most a white 
subpixel. 

Visual cryptography schemes with perfect reconstruction of black pixels 
have been analyzed in [12, 4, 3]. In particular, in [3] it was shown how to 
construct (T Q ua | , T For b)-VCSs with perfect reconstruction of black pixels having 
a pixel expansion m = X)Yer Qua i by using a technique proposed in [1]. 

More precisely, such a technique to constructs visual cryptography schemes 
with a perfect reconstruction of black pixels using small schemes as building 
blocks in the construction of larger schemes, as explained in the following. 
For i = 1, let (rg ua |, T} orb ) an access structure on a set V of n 

participants. If a participant j G V is not essential for the i - th access structure, 
we assume that j ^ T} orb and that j does not receive any share. Suppose there 
exists a (rQ ua |,T} orb )-VCS with a pixel expansion rrii and basis matrices Tf 
and Tf, for each i = The basis matrix S° (S' 1 , resp.) of a VCS for 

the access structure (TQ ua |,r F orb) where TQ ua | = TQ ua| U . . .ur^ ual and T Fo rb = 
Tjl orb n. • • CTporb is constructed as the concatenation of some auxiliary matrices 
Tf (T 1 , resp.), for each i = 1, . . . , q. Such matrices are obtained as follows: 
for each j = 1 , ... ,n, the j-tli row of T f (Tf, resp.) has all ones as entries if 
the participant j is not essential for (Tq^,, T} orb ), otherwise it is the row of 

Tf (Tf, resp.) corresponding to participant j. Hence, S° = Tf o Tf o ... o Tf 

and S 1 = Tf o Tf o ... o Tf, where o denotes the concatenation of matrices. 
The resulting VCS has a pixel expansion m = J2i= i m i- For a special class of 
access structures, such as threshold access structures and graph-based access 
structures, it is possible to design VCSs with the perfect reconstruction of 
black pixels achieving a smaller value of to, as shown in [1, 12, 3]. 

Example 2 Let V = {1,2, 3, 4} and T 0 = |{1, 2}, {2, 3}, {3, 4}|. We can 
construct a VCS with a perfect reconstruction of black pixels for the access 
structure having basis To by using three (2, 2 ) -threshold VCSs on the sets of 
participants {1,2}, {2, 3}, and {3,4}. The basis matrices T° and T 1 for the 
(2, 2 ) -threshold VCS described in Section 9.2.1 are 


rj-i 0 


1 0 
1 0 


T 1 


1 0 
0 1 


From T° and T 1 we construct the pair of matrices (Tf,Tf), for i = 1, ... ,3 
having four rows each , as follows: 


■ 1 

0 ' 


' 1 

0 ' 

1 

0 

Tl = 

0 

1 

1 

1 

1 

1 

1 

1 

1 


1 

1 
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T 2 ° = 


n= 


' 1 

1 ' 


■ 1 

1 ' 

1 

0 

Tf = 

1 

0 

1 

0 

2 

0 

1 

1 

1 


1 

1 

' 1 

1 ' 


■ 1 

1 ' 

1 

1 

To 1 = 

1 

1 

1 

0 

3 

1 

0 

1 

0 


0 

1 


Concatenating the matrices T^T®, and T g we obtain the basis matrix S° 


S° 


10 1111 
10 10 11 
1110 10 5 
111110 


whereas, concatenating the matrices Tp, T 2 , and Tg 1 we obtain the basis matrix 
S 1 


S 1 


10 1111 
0 110 11 
110 110 
11110 1 


The pixel expansion of the above construction is m = X^xer 0 ' 1 = 6. 


9.3 Almost Ideal Contrast VCS with Reversing 

In order to improve the contrast in VCSs, Viet and Kurosawa [13] introduced 
another noncryptographic operation, called reversing , which can be used by 
participants in the reconstruction phase. Such an operation, which can be 
easily performed by many copy machines, is applied to a transparency and 
creates another transparency in which black pixels are reversed to white pixels 
and viceversa. In the following, we will denote by t, the transparency obtained 
after applying the reversing operation to the transparency t. 

Viet and Kurosawa [13] showed how to construct a (TQ ua |,rForb)-VCS with 
reversing, where black pixels are perfectly reconstructed, whereas, white pixels 
are almost perfectly reconstructed. The idea behind their construction is to 
run several times the distribution phase of a (TQ ua |,rForb)-VCS with a perfect 
reconstruction of black pixels. The larger the number c of runs, the better the 
contrast of the resulting VCS with reversing. In particular, Viet and Kuro- 
sawa showed that if the contrast of the underlying VCS is q < 1, then the 
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contrast in their VCS with reversing is on the average q c . The price to pay 
to get an almost ideal contrast is the number of transparencies stored by each 
participant, which corresponds to the number c of runs. Moreover, there is a 
loss of resolution in their scheme, since each pixel in the original image corre- 
sponds to m subpixels in the reconstructed image, where m denotes the pixel 
expansion of the underlying VCS. 

In the distribution phase of the VCS with reversing in [13], the encoding 
of the secret image is handled pixel by pixel, where each pixel is considered 
independently of the others. For each pixel of the original image, the dealer 
runs c times independently a (rQ ua |,rF or t,)-VCS with a perfect reconstruction 
of black pixels and pixel expansion to; we denote by s\ the share for partici- 
pant i in run f, for i = 1 , ,n and £ = 1, ... ,c (notice that the transparency 
corresponding to such a share contains to subpixels for each pixel of the orig- 
inal image). In the reconstruction phase, any qualified set of participants can 
recover the original secret image by performing a sequence of stacking and 
reversing operations on their transparencies. The construction is described in 
Figure 9.1. 


Assume there exists a (T Q U ai , FfouO-VCS with a perfect reconstruction 

of black pixels. 

Distribution phase. For each pixel of the secret image, the dealer: 

• runs c times independently of the distribution phase of the underlying 
(F Quai , r Forb)-V CS; let sf be the share distributed to participant i in 
the l - tli run, for i = 1, . . . , n and l = 1, . . . , c; 

• distributes the c-tuple (sj , . . . , sf) to participant i. 

Reconstruction phase. A qualified set of participants 

reconstructs the secret pixel as follows: 

• superimpose their shares to get a e = OR(si 1 , . . . , sj p ), for £ = 
l,...,c; 

• reverse the results of the previous step to obtain a e , for £ = 1, . . . , c; 

• superimpose the results of the previous step to get (5 = 

ORia 1 , . . . , 5 C ); 

• finally, reverse the result of the previous step to obtain /3, which is 
the reconstructed pixel. 


FIGURE 9.1 

A construction for almost ideal contrast (rQ ua |, Tpor-tO-VCS with reversing. 

Notice that in the VCS with reversing described in Figure 9.1, the com- 
putation of the reconstructed pixel (3 corresponds to performing c — 1 AND 
operations, since (3 = ORia 1 , . . . , a c ) = AND(a 1 , . . . ,a c ). From the truth 
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table of the AND operator, it follows that the reconstructed pixel (3 will be 
black only when a 1 ,. .. ,a c are all black. Since each or corresponds to a re- 
constructed pixel in the £-th run of the underlying VCS with a perfect re- 
construction of black pixels, it follows that in the case a black pixel has been 
shared by the dealer, the reconstructed pixel (3 will be black no matter how 
many AND operations have been performed. On the other hand, in the case a 
white pixel has been shared, the reconstructed pixel (3 will increasily become 
whiter with the execution of the runs. Thus, if the contrast of the underlying 
VCS with a perfect reconstruction of black pixels is q < 1, then the contrast 
in the VCS with reversing described in Figure 9.1 is on the average q c . 

The security of the scheme directly follows from the security of the under- 
lying VCS. 

It is easy to see that the reconstruction phase requires a qualified set of p 
participants to perform exactly c + 1 reversing operations and cp — 1 stacking 
operations. Finally, notice that in the construction of Figure 9.1 there is a loss 
of resolution, since each pixel in the original image corresponds to m subpixels 
in the reconstructed image, where m denotes the pixel expansion of the under- 
lying VCS. For example, in the (fc, /c)-threshold VCS with reversing resulting 
from the above construction, each pixel of the original image corresponds to 
2 t ~ 1 subpixels in the reconstructed image. 

Example 3 Let V = {1,2, 3, 4} and T 0 = {{1, 2}, {2, 3}, {3, 4}} . The basis 

matrices S° and S 1 in a VCS realizing the access structure rQ ua | whose basis 
is r 0 are: 


' 0 

1 

1 

0 ■ 


■ 1 

0 

0 

1 ■ 

0 

0 

1 

1 

1 

1 

1 

1 

II 

'co 

1 

1 

1 

1 

1 

0 

0 

1 

1 

0 

1 

0 

1 


1 

0 

1 

1 

0 


The collections C 0 and C\ are obtained by permuting the columns of the cor- 
responding basis matrix (S° for Co, and S 1 for Ci) in all possible ways. First, 
consider two rounds where the shares generated for participant 1 are s{ = 0110, 
sf = 1100 whereas, the shares generated for the participant 2 are sJ; = 0111, 
= 1101. During the reconstruction phase, the two participants stack their 
shares and retrieve a 1 = OI?(s{,S 2 ) = 0111, a 2 = OB(sf,s 2 ) = 1101. By 
applying the reversing operation to each a 3 and stacking the results, they ob- 
tain (3 = Oi?(0111, 1101) = 1010. By reversing (3, they obtain f3 = 0101, 
and reconstruct a white pixel that consists of two out of four white sub- 
pixels. Now, let’s add a third round. Assume that the extra shares for par- 
ticipants 1 and 2 are s 3 = 1001 and = 1011, respectively. During the 
reconstruction phase, the two participants stack their shares and retrieve 
a 1 = Of?(s{,4) = 0111, a 2 = OR{s\,sl) = 1101, a 3 = OR(s?,s!) = 1011. 
By applying the reversing operation to each a° and stacking the results, 
they obtain j3 = Oi?(0111, 1101, 1011) = 1110. By reversing [3, they obtain 
(3 = 0001, and reconstruct a white pixel that consists of three out of four white 
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subpixels. Then, with an extra round the whiteness of the reconstructed pixel 
increases. 

Let S 1 be the matrix chosen by the dealer to share a black pixel. Consider 
two rounds. The shares generated for participant 1 are s} = 1001, sf = 1100, 
whereas , the shares generated for the participant 2 are = 1110, s\ = 0111. 
During the reconstruction phase, the two participants stack their shares and 
retrieve a 1 = OR(sl,s 2 ) = 1111, a 2 = OR(s 2 ,s 2 ) = 1111. By applying 
the reversing operation to each a 3 and stacking the results, they obtain /3 = 
Oi?(llll, 1111) = 0000. By reversing 0, they obtain 0 = 1111, and perfectly 
reconstruct a black pixel. It is easy to see that, by increasing the amount of 
rounds, the reconstruction of a black pixel continues to be perfect. 


9.4 Ideal Contrast VCS with Reversing 

The scheme proposed by Viet and Kurosawa [13] is said to have an almost 
ideal contrast because the black pixels are perfectly reconstructed, whereas, 
the white ones are almost perfectly reconstructed. The larger the number of 
runs, the more the whiteness of the reconstructed white pixels. However, a 
perfect reconstruction of both black and white pixels, corresponding to an 
ideal contrast, cannot be achieved by their scheme, even for a large number of 
runs. Moreover, the scheme proposed by Viet and Kurosawa [13] also has the 
following drawbacks: 

• Each participant is required to store c transparencies, where c denotes the 
number of runs for the underlying VCS; 

• The size of each transparency is m times the size of the original image, where 
to denotes the pixel expansion of the underlying VCS; 

• There is a loss of resolution in the reconstructed image; 

• A large number of runs is required to obtain an almost ideal contrast; 

• The underlying VCS has to be perfect black. 

In this section we describe different solutions for VCSs with reversing all 
achieving ideal contrast. Each solution further improves on the proposal by 
Viet and Kurosawa [13] by overcoming some of the above drawbacks. The 
first solution, described in Section 9.4.1, uses the fact that the introduction of 
the reversing operation allows participants to compute any Boolean function 
of their transparencies and uses as a building block a binary secret sharing 
scheme. The schemes described in Section 9.4.2 all use as a building block a 
perfect black VCS, whereas, the scheme in Section 9.4.3 is based on a non- 
perfect black VCS. 
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9.4.1 A Construction Using a Binary Secret Sharing Scheme 

In this section we describe an ideal contrast VCS with reversing for any access 
structure (rq ua |, Tporb), proposed in [6]. The scheme uses as a building block 
a binary secret sharing scheme (BSS for short). 

A BSS for an access structure (TQ ua |,rForb) on a set of n participants is a 
method to share a secret s £ {0, 1} among the n participants in such a way that 
only subsets of participants in TQ ua ] can recover the secret, whereas, subsets 
of participants in Tporb have no information about the secret. A BSS consists 
of two collections Bq and Bi of distribution functions. A distribution function 
/ £ Bq U Bi is a function associating each participant i to the share f(i). In 
the reconstruction phase, any qualified set of participants X = {ii,.. ■ ,i p } £ 
T Q ua [ run a reconstruction algorithm Rec (/(*i), . . . , /(i p )), which on inputs 
the shares they hold, outputs the secret s. See [7] for a formal definition of 
BSSs. Let r be the number of bits in the binary representation of the largest 
share /(?'). Without loss of generality (W.l.o.g.), we consider the r-bits binary 
representation of each share f(j) , where j ^ i, obtained by prefixing the 
r'-bits binary representation of f(j), where r' < r, with r — r' zeroes. The 
reconstruction algorithm Rec(f(ii),...,f(i p )) computes a Boolean function 
on its inputs. Such a function can be computed by using a Boolean circuit. 
It is well known that OR and NOT represent a complete basis for Boolean 
functions, i.e., any Boolean function can be computed by a binary circuit 
composed only of OR and NOT gates. Therefore, Rec(f(ii),...,f(i p )) can 
be computed by a Boolean circuit composed only of OR and NOT gates, 
corresponding to stacking and reversing operations, respectively. 

In the distribution phase of the VCS with reversing, the encoding of the 
secret image is handled pixel by pixel, where each pixel is considered inde- 
pendently of the others. For each pixel of the original image and for each par- 
ticipant i, the dealer generates the corresponding pixel in each transparency 
U,i, • • • , tj,r, where r is the size of the shares distributed by the underlying 
BSS. In the reconstruction phase, any qualified set of participants recover the 
original secret image with no loss of resolution by performing a sequence of 
stacking and reversing operations on their transparencies. Such a sequence of 
operations corresponds to simulating parallel runs of the reconstruction algo- 
rithm of the BSS, that is, one run for each pixel of the original image. Such 
a parallel execution enables the reconstruction of the original image, because 
each transparency contains the same number of pixels of the original image 
and each pixel can be reconstructed by using the same Boolean circuit. The 
construction is described in Figure 9.2. 

It is easy to see that the construction of Figure 9.2 gives an ideal contrast 
VCS with reversing with no loss of resolution. Indeed, let us consider the 
encoding pixel by pixel. Let X £ rQ ua | be a qualified set of participants. 
From the reconstruction property of the underlying BSS, the participants in 
X can reconstruct the secret pixel, by performing the sequence of stacking 
and reversing operations on their transparencies corresponding to the binary 
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Let (L Q ua i ; r Forb ) be an access structure on a set of n participants. Let 
Bo and Bi be the collections of distribution functions realizing a BSS 
for (L Quai 5 L Forb ) ■ Let r be the size of the shares distributed by the BSS. 

Distribution phase. To share a white (black, resp.) pixel of the orig- 
inal image, the dealer has to: 

• randomly choose a distribution function f £ Bo (resp. / £ Si), 

• for each participant i, consider the binary representation Si,i, . . . , S;, r 
of the share f(i) and, for each j = 1 , . . . , r, put a white (black, resp.) 
pixel on the transparency tij if Sij = 0 (stj = 1 , resp.). 

Reconstruction phase. Let X = {ii, , i p } £ rQ ua |. Participants in 
X reconstruct the secret image by performing the sequence of revers- 
ing and stacking operations on their transparencies, corresponding to 
the NOT and OR gates of the Boolean circuit computing in parallel 
Rec (/(ii), • . . , f(i P )), for each pixel of the original image, where / is 
the distribution function chosen to share that pixel. 


FIGURE 9.2 

A construction for ideal contrast VCS with reversing using a BSS. 


circuit simulating the reconstruction algorithm of the underlying BSS. The 
security of the scheme directly follows from the security of the underlying 
BSS. 

As shown in the following, we can construct an ideal contrast ( k , h)~ 
threshold VCS with reversing, with k > 2, where each participant has to 
store only one transparency, if we use as a building block a ( k , fc)-threshold 
BSS distributing shares of one bit. This improves on the construction for a 
(A:, fc)-threshold VCS with reversing of Figure 9.1, where each participant has 
to store c transparencies, each containing 2 fc_1 subpixels for each pixel of 
the original secret image, c being the number of runs of the underlying VCS 
needed to obtain an asymptotically ideal contrast. Indeed, consider the fol- 
lowing (fc, fc)-threshold BSS: to share a secret s £ {0, 1}, the dealer randomly 
chooses k — 1 random bits s i, . . . , Sk-i and computes Sk = s ® Si ® • • • © Sfc-i, 
where © denotes the XOR operation. For i = 1, . . . , k, the share for partic- 
ipant i is the bit Si. In order to reconstruct the secret s in the BSS the k 
participants are required to compute the XOR of their shares si © ■ ■ ■ © s*,. 
By arranging the k > 2 bits si, . . . , Sfc as the leaves of a binary tree of height 
[log k ~\ , where internal nodes have two children and the leaves are distributed 
on at most two levels, the problem of computing the XOR of k bits can be 
reduced to the problem of computing k — 1 pairwise XORs, corresponding 
to the internal nodes of the tree. Since each pairwise XOR operation can be 
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expressed in terms of 3 ORs and 4 NOTs as follows: 


Si ® Sj = OR(OR(s i: Sj),OR(si,Sj ) ), 


then, the computation of each pairwise XOR can be performed by using a 
Boolean circuit, having a depth 4, constituted only by OR and NOT gates. 
Therefore, the computation of Si ® • • • ® Sk can be performed by a Boolean 
circuit having a depth 4 [log k] . 

In the corresponding VCS with reversing, for each pixel of the original 
image, the dealer runs the distribution phase of the BSS, and, for each partic- 
ipant i, generates on the transparency t, the pixel corresponding to the share 
Si distributed by the BSS. In order to reconstruct the secret image, the k 
participants are involved in a computation consisting of stacking and revers- 
ing their transparencies, simulating the circuit computing the XOR, which is 
composed only by OR and NOT gates. It is easy to see that the number of 
reversing and stacking operations needed to reconstruct the secret image is 
equal to 4 (k — 1) and 3 {k — 1), respectively. 

Example 4 Let k = 4. If the dealer wants to share a white pixel, he runs 
the distribution phase of the BSS for the secret s = 0. Hence, he randomly 
chooses three bits si, S2, and s 3, and computes S4 = s ® Si ® S2 ® £3- For 
example, let si = 1, S2 = 0, S3 = 0, then S4 = 1. The corresponding pixels 
in the transparencies <1,0, £3, £4 are equal to 1,0,0, 1, respectively. In order 
to reconstruct the secret pixel, the participants have to simulate the compu- 
tation of si ® S2 ® S3 ® S4 by performing a sequence of stacking and revers- 
ing operations on their transparencies. Notice that s = s 1 ® S2 ® S3 ® S4 = 
(si ® s 2 ) ® (s 3 ® S4). Sinc e a = si Q s 2 == OR( OR(s 1, s 2 ), OR(si, s-j) ) = 1 
and b = S3 ® S4 = OR( ORlfs^, S4), OR(s3, S4) ) = 1, it follows that the 
four participants can reconstruct the secret pixel corresponding to the secret 
s = a ® b = OR( OR(a , b ), OR(a,b) ) = 0 by performing 12 reversing opera- 
tions and 9 stacking operations. 


9.4.2 Constructions Using Perfect Black VCSs 

In this section we describe different constructions using as a building block 
a perfect black VCS. In particular, the solution described in Section 9. 4. 2.1 
requires each participant to store m transparencies, where m denotes the pixel 
expansion of the underlying perfect black VCS, and offers no loss of resolution. 
The scheme described in Section 9. 4. 2. 2 still offers no loss of resolution, but 
requires each participant to hold two transparencies having a large size, i.e., 
|T 0 1 times the size of the secret image. Finally, the scheme in Section 9. 4. 2. 3 
reduces the number of transparencies stored by each participant to m — h + 1, 
but there is a loss of resolution on the reconstructed image. 
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9. 4. 2.1 The Scheme by Cimato, De Santis, Ferrara, and Masucci 

In this section we describe a general technique, due to Cimato, De Santis, 
Ferrara, and Masucci [6], to construct an ideal contrast VCS with reversing for 
any access structure (rq ua |, r Forb ). The scheme uses as a building block a VCS 
with perfect reconstruction of black pixels, having a certain pixel expansion 
m, and requires each participant to store m transparencies, each having the 
same number of pixels as the original image. 

In the distribution phase of the scheme, the encoding of the secret image 
is handled pixel by pixel, where each pixel is considered independently of the 
others. For each pixel of the original image and for each participant i, the 
dealer generates the corresponding pixel in each transparency tip , . . . , fy m . In 
the reconstruction phase, any qualified set of participants recover the original 
secret image with no loss of resolution by performing a sequence of stacking 
and reversing operations on their transparencies. The construction is described 
in Figure 9.3. 


Let (r Quai , F Forb) be an access structure on a set of n participants. 
Let Co and Ci be the collections of Boolean matrices constituting a 
(r Quai , r Forb) - VCS with a perfect reconstruction of black pixels and pixel 
expansion m. 

Distribution phase. To share a white (black, resp.) pixel, the dealer 
has to: 

• randomly choose a matrix S = [siq] in Co ( S in Ci, resp.); 

• for each participant i, consider the m bits s»,i, . , Si, m composing 
the *-th row of S and, for each j = l,...,m, put a white (black, 
resp.) pixel on the transparency Uj if Sij = 0 (sij = 1, resp.). 

Reconstruction phase. Let A' = {*i, . . . ,i p j £ TQ ua |. Participants in 
X reconstruct the secret pixel by computing: 

• aj = OR(s illj ,...,s ip , j ), for j = 1 

• a], for j = 1 

• P = OR(oR, • • • ,a^T); 

• p, which is the reconstructed pixel. 


FIGURE 9.3 

Cimato, De Santis, Ferrara, and Masucci’s ideal contrast VCS with reversing. 

It is easy to see that the construction of Figure 9.3 gives an ideal contrast 
(rQuai,r For b)-VCS with reversing. Indeed, let us consider the encoding pixel by 
pixel and analyze separately the reconstruction phase in case the dealer shared 
a white pixel or a black pixel. Let X = {ii, , i p } £ rQ ua | be a qualified subset 
of participants and assume that the secret pixel shared by the dealer was 
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white. From Property 1. of Definition 1, there exists an index j E {1, . . . , to} 
for which the encoded pixels in each transparency t^j , . . . ,ti P ,j are all white. 
It follows that for the same j, ctj = 0 and j3 = ORfai , . . . , afh) is equal to 1. 
Then, (3 is zero, i.e., the reconstructed pixel will be white. Now, assume that 
the secret pixel shared by the dealer was black. Since the underlying scheme 
is a (r Qua |,r Fo rb)-VCS with a perfect reconstruction of black pixels, it holds 
that ctj = 1, for j = 1, . . . , to. Hence, (3 = OR(ai, . . . , a m ) is zero and [3 = 1, 
i.e., the reconstructed pixel will be black. The security of the scheme directly 
follows from the security of the underlying VCS. 

Compared to the scheme described in Figure 9.1, the one of Figure 9.3 
requires each participant to store to transparencies, each having the same 
number of pixels as the original image. Furthermore, the scheme requires a 
qualified set of p participants to execute exactly to + 1 reversing operations 
and mp — 1 stacking operations. Finally, the reconstructed image has no loss 
of resolution. 

Example 5 Let V = {1,2, 3, 4} and T 0 = | (1, 2}, {2, 3}, {3, 4}| . The basis 

matrices S° and S 1 in a VCS realizing the access structure rQ ua | whose basis 
is To are: 


' 0 

1 

1 

0 ' 


' 1 

0 

0 

1 ' 

0 

0 

1 

1 

1 

1 

1 

1 

s 1 = 

1 

1 

1 

1 

1 

0 

0 

1 

1 

0 

1 

0 

1 


1 

0 

1 

1 

0 


The collections Cq and Ci are obtained by permuting the columns of the corre- 
sponding basis matrix (S° for Co, and S 1 for C\) in all possible ways. Let S° 
be the matrix chosen by the dealer to share a white pixel. The corresponding 
pixels generated for the transparencies tip, . . . , tip for participant 1 are 0, 1, 
1, and 0, whereas, the pixels generated for the transparencies t^p, ■ ■ ■ , t2,4 for 
participant 2 are 0, 1, 1, and 1. During the reconstruction phase, the two par- 
ticipants stack their shares and retrieve op =0,02 = 1,0:3 = 1,04 = 1. By 
applying the reversing operation to each a.j and stacking the results, they ob- 
tain /3 = OR( 0, 1, 1, 1) = 1. By reversing (3, they obtain (3=0, and reconstruct 
a white pixel. 

Let S 1 be the matrix chosen by the dealer to share a black pixel. The cor- 
responding pixels generated for the transparencies tip, . . . , tip for participant 
1 are 1, 0, 0, and 1 , whereas, the corresponding pixels generated for the trans- 
parencies < 2 p, . . . , t 2,4 for participant 2 are 111, and 0. During the reconstruc- 
tion phase, the two participants will perform the same operation sequence as 
before, retrieving op = 1, 02 = 1, 03 = 1, 04 = 1, (3 = OR( 1, 1, 1, 1) = 0, and 
(3 = 1, reconstructing a black pixel. 

Notice that if the qualified set X S rQ ua | is a superset of an X' G r 0 , 
then, in the reconstruction phase, participants in X can recover the secret 
image by performing the given sequence of operations on the subset of trans- 
parencies held by participants in X' only, thus reducing the total number of 
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operations. A further improvement can be obtained by considering as a build- 
ing block a (r Qua |,r F orb)-VCS with a perfect reconstruction of black pixels 
having a smaller pixel expansion than m = ^Yer,, , In particular, 

by considering the set To of all the minimal qualified subsets, and by using 
the same technique proposed in [1], it is possible to construct a (rQ ua |, r For b)- 
VCS with a perfect reconstruction of black pixels, having pixel expansion 
m! = thus reducing the number of transparencies held by each 

participant. 

9. 4. 2. 2 The Scheme by Hu and Tzeng 

In this section we describe an ideal contrast VCS with reversing for any access 
structure (rQ ua |, IVorb)) due to Hu and Tzeng [9]. The construction uses the 
basis matrices of the Naor-Shamir’s ( k , k)-V CS described in Section 9.2.1 along 
with the properties of the XOR operator. 

Let S° and S 1 be the basis matrices of the Naor-Shamir’s (fc, fc)-VCS. The 
key idea behind Hu and Tzeng’s construction relies upon the fact that the 
XOR of the bits belonging to a column of S' 0 (S 1 , respectively) is zero (one, 
respectively). With such an observation in mind, a (fc, fc)-V CS with reversing 
may be easily constructed by issuing to the participant i a transparency of 
the same size as the original image constructed as follows: for each white 
(black, respectively) pixel the dealer chooses a column in S° (S' 1 , respectively) 
and puts on the transparency the i-tli item of the chosen column. Since each 
column of S° (S 1 , respectively) has an even (odd, respectively) number of 
ones, it is easy to see that by XORring k transparencies the original image is 
reconstructed without any loss of resolution. In the following we refer to this 
construction as the XOR-(/c, fc)-VCS. As seen in Section 9.4.1, the problem 
of computing the XOR of k transparencies can be reduced to a sequence of 
stacking and reversing operations. 

By using |L 0 1 executions of the XOR-(fc, fc)-VCS, a naive VCS with revers- 
ing for any access structure (F Q ua i , L F or b) can be obtained. Indeed, we simply 
execute the above XOR-(|A'|, |X|)-VCS for each qualified set X e r 0 . Such a 
solution requires each participant to store as many transparencies as the num- 
ber of qualified sets he belongs to. Each transparency has the same size as the 
original image, on the other hand, each participant needs to keep track of the 
correspondence between a transparency and the related qualified set. In order 
to overcome such a drawback, Hu and Tzeng proposed a way to combine the 
transparencies distributed to a participant in a single transparency. Such a 
transparency is then used by a participant in a qualified set along with an ad- 
ditional transparency to reconstruct the original image. Both transparencies 
held by each participant are |Fo | times larger than the size of the secret im- 
age. Indeed, each transparency contains |F 0 1 blocks and each qualified subset 
of participants reconstructs, without loss of resolution, the secret image in a 
single block, whereas the other reconstructed blocks contain only white pixels. 
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Compared to the naive solution, the scheme introduces some computational 
overhead by requiring additional stacking and reversing operations. 

In the distribution phase, for each qualified set X in To and each par- 
ticipant i £ X the dealer generates the subtransparency tx,i resulting by 
applying the XOR-(|X|, |Xj)-VCS on the set of participants X. For each 
set X in To such that the participant i does not belong to X, the dealer 
generates the subtransparency tx.i consisting of all ones. Each participant 
i receives a transparency tj corresponding to the concatenation of its sub- 
transparency according to an ordering over the qualified sets in To- Hence, let 
Xi, . . . , X|r 0 | be the qualified sets in To, each participant i receives the trans- 
parency U = tx, a o ... o tjy ro | ,ii where o denotes the concatenation between 
transparencies. Each participant i also receives an additional transparency 
t[ of the same size as ti such that each subtransparency t' x i has all ones if 
the participant i does not belong to the qualified set X whereas it (to re- 
peat the subject that is each sub transparency) has all zeros, otherwise. The 
construction is described in Figure 9.4. 


Let (F Q ua i , r Forb ) be an access structure on a set of n participants. 

Distribution phase. For each qualified set X £ To the dealer has to: 

• execute the XOR-(|X| , |X|)-VCS on A' to generate the sub- 
transparency tx,i for each participant i £ X; 

• for each i £L X, generate the subtransparency tx,i consisting of all 
ones; 

• for each i £ X, generate a subtransparency t'x i of the same size of 
the original image, having all zeros; 

• for each i $ X . generate a subtransparency t' x . t of the same size of 
the original image, having all ones; 

• distribute to participant i the transparencies ti = tx 1: i o . . . o tx| F |,i 
and t'i = tf Xl ,i o ... °4 |ro |,r 

Reconstruction phase. Let X = {ii,...,i p } be a qualified set in 

r Q ua i . Participants in X reconstruct the original image by computing: 

• T = XOR{ti x ,..., ti p ); 

. T'«OR(4,...,t' p ); 

• U = OR(T,T '); 

• US' = XOR(U,T'), which corresponds to the original image. 


FIGURE 9.4 

Hu and Tzeng’s ideal contrast VCS with reversing. 

It is easy to see that the i-tli qualified set obtains the original image in place 
of the *-th subtransparency of U' while all other subtransparencies contains 
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all zeros. Indeed, the matrix corresponding to the i-th. subtransparency of U' 
is the same as the *-th subtransparency of T, which from the property of 
the XOR operator and the composition of the Naor-Shamir basis matrices 
corresponds to the original image. Moreover, the matrices corresponding to 
the subtransparency of U but the i-th one contains all ones. Hence, from the 
property of the XOR operator such subtransparencies contains all zeros in U' . 

The reconstruction phase requires a qualified set of p participants to per- 
form exactly 4 p reversing operations and 4p — 1 stacking operations, since, as 
seen in Section 9.4.1, the XOR operation can be implemented by means of 3 
ORs and 4 NOTs operations. 

Example 6 LetV = {1,2, 3, 4}, T 0 = { X 1 ,X 2 } = {{1, 4}, {2, 3, 4}}} . Let 

Si and Si be the basis matrices associated to the XOR-(2,2)-VCS for Xi and 
let S% and S'} basis matrices associated with the XOR-(3,3)-VCS for 

X 2 defined as follows: 


S? = 


1 0 
1 1 
1 1 
1 0 


Let I = 
as follows: 


S 2 U = 


10 1 
0 10 


1111 
0 0 11 
0 10 1 
0 110 


s} = 




1 0 
1 1 
1 1 
0 1 

1111 
110 0 
10 10 
10 0 1 


be the original image. The transparencies are computed 



' 1 

1 

0 

1 

1 

1 ' 

II 

'so 

' 0 

0 

0 

1 

1 

1 ■ 


0 

1 

1 

1 

1 

1 

0 

0 

0 

1 

1 

1 


' 1 

1 

1 

1 

0 

1 ' 

4 = 

■ 1 

1 

1 

0 

0 

0 ' 


1 

1 

1 

0 

0 

1 

1 

1 

1 

0 

0 

0 


' 1 

1 

1 

1 

0 

0 ' 

t' 3 = 

■ 1 

1 

1 

0 

0 

0 ' 


1 

1 

1 

1 

1 

0 

1 

1 

1 

0 

0 

0 


' 0 

1 

1 

1 

0 

0 ' 

4 = 

' 0 

0 

0 

0 

0 

0 ' 


0 

0 

1 

1 

0 

1 

0 

0 

0 

0 

0 

0 


Participants in X 2 = {2,3,4} reconstruct the original image by computing 


■ 1 

0 

1 

0 

1 

1 

rpf 

' 0 

0 

0 

1 

1 

1 ■ 

0 

1 

0 

0 

1 

0 

1 — 

0 

0 

0 

1 

1 

1 

■ 1 

0 

1 

1 

1 

1 ■ 

II 

b 

1 

0 

1 

0 

0 

0 ' 

0 

1 

0 

1 

1 

1 

0 

1 

0 

0 

0 
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9. 4. 2. 3 The Scheme by Yang, Wang, and Chen 

Yang, Wang, and Chen [14] proposed a different method to construct a VCS 
with reversing starting from any perfect black VCS with pixel expansion m. 
In their scheme each participant receives m — h + 1 shares, where the first 
one corresponds to the one obtained by the underlying perfect black VCS, 
whereas the i-tli share is obtained by cyclically shifting the [i — l)-th share 
one bit to the right, for each i = 2, . . . , m — h + 1. Notice that the right shift 
operation can be implemented by means of OR and NOT operations, since 
OR and NOT represent a complete basis for Boolean functions. 

The scheme is shown in Figure 9.5. 


Assume there exists a (T Q U ai , rForb)-VCS with a perfect reconstruction 

of black pixels. Let $(■) be a one-bit cyclical right-shift function. 

Distribution phase. For each pixel of the secret image, the dealer: 

• runs the distribution phase of the underlying (FQ ua i, rF or b)-VCS; let 
sj be the share distributed to participant i, for i = 1 , . . . , n; 

• for each £ = 2, . . . , m — h + 1, compute sf = 4>(sf _1 ); 

• distributes the (m — h + l)-tuple (s* , . . . , s™~ h+1 ) to participant i. 

Reconstruction phase. A qualified set of participants 

reconstructs the secret pixel as follows: 

• superimpose their shares to get a e = OR^s ^, . . . , sf p ), for I = 
1, . . . , m — h + 1; 

• reverse the results of the previous step to obtain ar , for i = 1, . . . , m— 
h -f- 1; 

• superimpose the results of the previous step to get /3 = 

• finally, reverse the result of the previous step to obtain (3, which is 
the reconstructed pixel. 


FIGURE 9.5 

Yang, Wang, and Chen’s ideal contrast VCS with reversing. 

The reconstruction phase is the same as that of the scheme shown in Figure 
9.1. Recall that the computation of the reconstructed pixel [3 corresponds to 
performing m — h + 1 AND operations, since /3 = OR^a 1 , . . . ,a m ^ h+1 ) = 
AND(a 1 , . . . , a m ~ h+1 ). It is easy to see that the construction of Figure 9.5 
achieves a perfect reconstruction of both white and black pixels. Indeed, in the 
case a white pixel has been shared, a 1 contains h white subpixels and m — h 
black ones. The maximum interval between two Os in a 1 is m — h, thus, by 
shifting right one bit (to — h) times, there is at least an a 1 having a subpixel 
equal to 0 at position j, for each i = 1 , . . . , m — h + 1 and j = 1 , . . . , to . 
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Therefore, the reconstructed pixel f3 = AND(a 1 , . . . , a m ~ h+1 ) results in all 
white subpixels. On the other hand, in case a black pixel has been shared, a 1 
contains all black subpixels, for each i = 1, . . . , m — h+ 1, thus also (3 perfectly 
reconstructs the pixel. 

The security of the scheme directly follows from the security of the under- 
lying VCS. 

The reconstruction phase requires a qualified set of p participants to per- 
form exactly m — h + 2 reversing operations and (to — h + 1 )p — 1 stacking 
operations. Finally, notice that in the construction of Figure 9.5 there is a loss 
of resolution, since each pixel in the original image corresponds to to subpix- 
els in the reconstructed image, where to denotes the pixel expansion of the 
underlying VCS. 

Example 7 Let V = {1,2, 3, 4} and T 0 = |{1, 2}, {2, 3}, {3, 4}| . The basis 

matrices S° and S 1 in a VCS realizing the access structure rQ ua | whose basis 
is To are: 


' 0 

1 

1 

0 ' 


' 1 

0 

0 

1 ' 

0 

0 

1 

1 

1 

1 

1 

1 

Co 

II 

1 

1 

1 

1 

1 

0 

0 

1 

1 

0 

1 

0 

1 


1 

0 

1 

1 

O 


The collections Cq and Ci are obtained by permuting the columns of the corre- 
sponding basis matrix (S° for Co, and S 1 for C\) in all possible ways. Let S° 
be the matrix chosen by the dealer to share a white pixel. Notice that to = 4, 
h = 1, and m—h+1 = 4. The shares generated for participant 1 are s{ = 0110, 
sf = 0011, s 3 = 1001, and sf = 1100, whereas , the shares generated for the 
participant 2 are s \ = 0111, s 2 = 1011, s| = 1101, and sf = 1110. During 
the reconstruction phase, the two participants stack their shares and retrieve 
a 1 = OR(sf,sf) = 0111, a 2 = OR{s\,sl) = 1011, a 3 = OR(sf,sl) = 1101, 
and a 4 = OR(sf,sf) = 1110. By applying the reversing operation to each a? 
and stacking the results, they obtain [3 = Oi?(0111, 1011, 1101, 1110) = 1111. 
By reversing (3, they obtain f3 = 0000, and reconstruct a white pixel. 

Let S 1 be the matrix chosen by the dealer to share a black pixel. The 
shares generated for participant 1 are s{ = 1001, s \ = 1100, s 3 = 0110, and 
s{ = 0011, whereas, the shares generated for the participant 2 are S 2 = 1110, 
s| = 0111, s| = 1011, and s| = 1101. During the reconstruction phase , the 
two participants stack their shares and retrieve a 1 = Oi?.(s{, S 2 ) = 1111, a 2 = 
OR( y s\,sf) = 1111, a 3 = Oi?(sf,s|) = 1111, and a 4 = OR(sf,s 2 ) = 1111. 
By applying the reversing operation to each a - 7 and stacking the results, they 
obtain (3 = Oi?(llll, 1111, 1111, 1111) = 0000. By reversing f3, they obtain 
(3 = 1111, and reconstruct a black pixel. 
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9. 4. 2. 4 Comparisons 

The efficiency of a VCS with reversing is evaluated according to the follow- 
ing parameters: the contrast, the size (expansion) and the number of the 
transparencies held by each participant, the number of stacking and reversing 
operations, and the size (expansion) of the reconstructed image. In Table 9.1 
we summarize and compare the parameters of the constructions described in 
Sections 9.3 and 9.4.2., which are all based on perfect black VCSs for a general 
access structure (rQ ua |, Tporb)- 


TABLE 9.1 

Comparison between VCSs with reversing based on perfect black VCSs. 


Scheme 

Contrast 

Share 

exp. 

Number 
of shares 

Number 

OR oper. 

Number 
NOT oper. 

Secret 

exp. 

Fig. 9.1 

Almost 

ideal 

m 

c 

cp— 1 

c+1 

m 

Fig. 9.3 

Ideal 

NO 

m 

mp— 1 

m + 1 

NO 

Fig. 9.4 

Ideal 

|Uo| 

2 

4p — 1 

4 p 

NO 

Fig. 9.5 

Ideal 

m 

m—h+1 

(m— h+l)p— 1 

m — h + 2 

m 


9.4.3 A Construction Using a Nonperfect Black VCS 

Yang, Wang and Chen [14] proposed a way to construct an ideal VCS with 
reversing when the difference h — t is odd, starting from any VCS (i.e. , not 
necessarily a perfect black) with pixel expansion to. Each participant receives 
to shares, where the first one corresponds to that obtained by the underlying 
VCS, whereas, the i-th share is obtained by cyclically shifting the (i — 1)- 
th share one bit to right, for each i = 2, . . . , to. Notice that the right shift 
operation can be implemented by means of OR and NOT operations, since 
OR and NOT represent a complete basis for boolean functions. 

The scheme is shown in Figure 9.5. 

The construction of Figure 9.5 achieves perfect reconstruction of both 
white and black pixels. Indeed, in case a white pixel has been shared, a 1 
contains h white subpixels and to — h black ones. By shifting right one bit 
to times, ad, ... , a m are constructed in such a way that exactly (to — h) out 
of to have a black subpixel at position j, for each j = 1 , ... ,m. Therefore, 
f3 = XOR(a x , . . . , a m ) is the reconstructed white pixel if (to — h) is even, 
otherwise the reconstructed pixel is /3. On the other hand, since h — £ is odd, 
i.e. h and l cannot be both odd or both even, if (to — h) is even (odd, resp.) 
it holds that to — l is odd (even, resp.). Hence, in the case a black pixel has 
been shared, a 1 contains t white subpixels and to — l black ones. By shifting 
right one bit to times, a 1 , . . . , a m are constructed in such a way that exactly 
(m — £) out of to have a black subpixel at position j, for each j = 1, . . . , to. 
Therefore, (3 = XOR{a 1 , . . . , a m ) is the reconstructed black pixel if (to — h) 
is even, i.e., (m — t) is odd, otherwise the reconstructed pixel is (3. 
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Assume there exists a (rQ ua |, rF or b)-VCS with pixel expansion m. Let <&(•) be a one-bit 
cyclical right shift function and let ( h — i) be odd. 

Distribution phase. For each pixel of the secret image, the dealer: 

• runs the distribution phase of the underlying (FQ ua |, FF or b)-VCS; let sj be the share 
distributed to participant i, for i = 1 , . . . , n; 

• for each £ = compute sf = 4>(sf _1 ); 

• distributes the m-tuple (s 3 , . . . , sf 1 ) to participant i. 

Reconstruction phase. A qualified set {ii, . . . ,i p } of participants reconstructs the 
secret pixel as follows: 

• superimpose their shares to get or = OR{s { 1 , . . . , sf p ), for l = 1, . . . ,m; 

• compute P = XOR(a 1 , . . . , a m ), which is the reconstructed pixel if (m — h) is even, 
otherwise the reconstructed pixel is /3. 


FIGURE 9.6 

Ideal contrast VCS with reversing starting from any VCS. 


The security of the scheme directly follows from the security of the under- 
lying VCS. 

The reconstruction phase requires a qualified set of p participants to per- 
form exactly 4 (to — 1) reversing operations and p — 1 + 3 (m — 1) stacking 
operations, since as seen in Section 9.4.1 the XOR operation can be imple- 
mented by means of 3 ORs and 4 NOTs operations. Finally, notice that in the 
construction of Figure 9.5 there is a loss of resolution, since each pixel in the 
original image corresponds to m subpixels in the reconstructed image, where 
to denotes the pixel expansion of the underlying VCS. 

Example 8 Consider a (2, 3 ) -threshold VCS, which is not a perfect black, 
where m — h is odd. Assume the basis matrices S° and S 1 are: 


■ 1 

0 

0 ' 


' 1 

0 

0 ' 

1 

0 

0 

5 3 = 

0 

1 

0 

1 

0 

1 

0 


1 

0 

0 

1 


The collections Co and C\ are obtained by permuting the columns of the corre- 
sponding basis matrix (S° for Co, and S 1 for C\) in all possible ways. Let S° 
be the matrix chosen by the dealer to share a white pixel. The shares generated 
for participant 1 are sj = 100, sf = 010 and s 3 = 001, whereas, the shares 
generated for the participant 2 are s \ = 100, s| = 010, and sf! = 001. During 
the reconstruction phase, the two participants stack their shares and retrieve 
a 1 = O R(s \ , S 2 ) = 100, a 2 = Oi?(sf,s|) = 010, and a 3 = Oi?(sf,S 2 ) = 001. 
By computing j3 = X O Rfa 1 , a 2 , a 3 ) = 111 and its reverse p) = 000 the two 
participants reconstruct a white pixel. 
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Let S 1 be the matrix chosen by the dealer to share a black pixel. The 
shares generated for participant 1 are s) = 100, sf = 010 and sf = 001, 
whereas, the shares generated for the participant 2 are s \ = 010, s\ = 001 
and = 100- During the reconstruction phase, the two participants stack 
their shares and retrieve a 1 = OR(s\, sjjj) = 110, a 2 = OR(s 2 , s|) = Oil, and 
a 3 = Oi?(sf,S 2 ) = 101. By computing (3 = XOR(a 1 ,a 2 ,a 3 ) = 000 and its 
reverse (3 = 111 the two participants reconstruct a black pixel. 


9.5 Conclusions 

Visual cryptography schemes are characterized by two parameters: the pixel 
expansion, i.e. , the number of subpixels contained in each share and the con- 
trast, which measures the difference between a black and a white pixel in the 
reconstructed image. While it is possible to construct schemes with perfect re- 
construction of black pixels (or white pixels, respectively), it has been shown 
that a perfect reconstruction of both black and white pixels is infeasible. In 
order to improve the contrast in VCSs, Viet and Kurosawa [13] introduced an 
extra noncryptographic operation: the reversing operation. Specifically, they 
showed how to construct VCSs with reversing where the reconstruction of 
black (white, respectively) pixels is perfect, whereas, the reconstruction of 
white (black, respectively) pixels is almost perfect. Afterwards, Cimato et 
al. [6] showed how to construct VCSs with reversing where reconstruction of 
both black and white pixels is perfect. Such schemes are said to have an ideal 
contrast. In particular, Cimato et al. [6] proposed two different constructions. 
One uses as a building block a VCS with perfect reconstruction of black pixels 
while the other construction uses as a building block a binary secret sharing 
scheme. Subsequently, new constructions for visual cryptography with revers- 
ing have been described in [9, 14]. In particular, [9] considered the problem of 
minimizing the number of the shares held by each participant while in [14] the 
need of using as a building block a VCS with perfect reconstruction of black 
pixels is removed. 
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10.1 Introduction 

In 1994, Naor and Shamir proposed a variant of secret sharing called Visual 
Cryptography (VC) [9], where the shares given to participants are xeroxed 
onto transparencies. If X is an authorized subset, then the participants in X 
can visually recover the secret image by stacking their transparencies together 
without performing any computation. One special property distinguishes VC 
from conventional secret sharing scheme [16, 17] is that the security of VC is 
achieved by losing the contrast and the resolution of the secret image. In other 
words, the quality of the reconstructed secret image is inferior to that of the 
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original secret image. Since the invention of VC, many researchers have de- 
voted themselves to enhancing the contrast and resolution of the reconstructed 
images [1, 3] and to extending it to general access structures [7]. Moreover, 
many schemes to visually share nonbinary secret images, such as gray- level 
secret images [2, 5] and color secret images [12, 13], were also proposed. There 
are lots of applications based on VC, for example, visual authentication and 
identification [10], steganography [4, 6, 8], and image encryption [14]. 

In 2006, Horng et al. showed that cheating is possible in the fc-out-of-n VC 
[8]. The cheating activity could cause unpredictable damage to victims be- 
cause they will accept a forged image different from the actual secret image as 
authentic. In this chapter, we survey some recently proposed cheating preven- 
tion schemes in VC and provide a comparative evaluation of their advantages 
and disadvantages. 

The rest of this chapter is organized as follows. Section 10.2 provides pre- 
liminary background on VC and the cheating activities. Section 10.3 surveys 
some cheating prevention schemes. Their comparative analyses are in Section 
10.4. Finally, conclusions and some research issues are given in Section 10.5. 


10.2 Preliminaries 
10.2.1 Visual Cryptography 

A visual secret sharing scheme is a special variant of a fc-out-of-n secret sharing 
scheme where the shares given to participants are xeroxed onto transparencies. 
Therefore, a share is also called a transparency. If X is a qualified subset, then 
the participants in A' can visually recover the secret image by stacking their 
transparencies without performing any cryptographic computation. Usually, 
the secret is an image. To create the transparencies, each black and white 
pixel of the secret image is handled separately. It appears as a collection of m 
black and white subpixels in each of the n transparencies. We will call these 
m subpixels a block. Therefore, a pixel of the secret image corresponds to nm 
subpixels. We can describe the nm subpixels by an n x to Boolean matrix, 
called a base matrix , S = [SV,] such that Sn = 1 if and only if the j th subpixel 
of the i th share is black and Sij = 0 if and only if the j th subpixel of the i th 
share is white. The gray level of the stack of k shared blocks is determined by 
the Hamming weight H(V) of the ”OR”ed to- vector V of the corresponding 
k rows in S. This gray level is interpreted by the visual system of the users as 
black if H(V) > d and as white if H(V) < d — a * rn for some fixed threshold 
d and relative difference a. We would like to to be as small as possible and a 
to be as large as possible. 

More formally, a solution to the fc-out-of-n VC consists of two collections 
C° and C 1 of n x to base matrices. To share a white pixel, the dealer randomly 
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FIGURE 10.1 

Visual cryptography. 


chooses one of the matrices from C°, and to share a black pixel, the dealer 
randomly chooses one of the matrices from C 1 . The chosen matrix determines 
the m subpixels in each one of the n transparencies. Figure 10.1 shows the 
basic concept of visual cryptography. 

Definition 1 A solution to the fc-out-of-n VC consists of two collections 
C° and C 1 of n x m base matrices. The solution is considered valid if the 
following conditions are met: 

Contrast conditions: 

1. For any matrix S° in C°, the ”or” V of any k of the n rows satisfies H(V) < 
d— a * to. 

2. For any matrix S' 1 in C l , the ”or” V of any k of the n rows satisfies H(V) > 

d. 

Security condition: 

3. For any subset {A, i 2 , . . . , i q } of {1, 2, ... , n} with q < k, the two collections 
D° , D 1 of q x to matrices obtained by restricting each n x to matrix in C°, C 1 
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FIGURE 10.2 

The concept of 2-out -of-2 VC. 



FIGURE 10.3 

A 2-out-of-3 visual secret sharing scheme. 
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to rows K 1 i q are indistinguishable in the sense that they contain the 
same matrices with the same frequencies. 

Figure 10.2 shows the basic concept of a 2-out-of-2 visual secret sharing 
scheme. The secret image is shared through two noise-like transparencies: Tf 
and T 2 . In this case, a block consists of 4 subpixels. Each black(white) pixel 
of the secret image is turned into two black and two white subpixels of T} and 
T 2 . Figure 10.3 shows an example of a 2-out-of-3 visual secret sharing scheme. 


10.2.2 Cheating in VC 


In [8], Horng et al. showed that cheating is possible in fc-out-of-n VC. Let’s 
take the 2-out-of-3 visual secret sharing scheme shown in Figure 10.3 as an 
example. A secret image is encoded into three distinct transparencies, denoted 
Ti, T 2 , and T 3 . Then, the three transparencies are respectively delivered to 
Alice, Bob, and Carol. Without loss of generality, Bob and Carol are assumed 
to be collusive cheaters and Alice is the victim. During the cheating activity, 
Bob and Carol use S 2 and S 3 to create forged transparency S' 2 such that su- 
perimposing S 2 and S 3 will visually recover the cheating image as in Figure 
10.4. Precisely, by observing the following collections of 3 x 3 matrices that 
are used to generate transparencies, collusive cheaters can predict the actual 
structure of the victim’s transparency so as to create S' 2 . 


C° = {all the matrices obtained by permuting the columns of 


C 1 = {all the matrices obtained by permuting the columns of 


10 0 
10 0 } 
10 0 
1 0 0 = 

0 10 } 
0 0 1 


By observing the above matrices, two rows of above C° or C 1 matrix are de- 
termined by collusive cheaters. Therefore, the structure of the corresponding 
block of Si is exact the remaining row. For presenting a white pixel of cheating 
image, the block of S 2 is set to be the same structure of Si. For presenting a 
black pixel of cheating image, the block of S 2 is set to be the different struc- 
ture of Si. For example, if the block of Si is [010], then S 2 is set to be [010] 
for a white pixel or it is set to be [001] for a black pixel. 

We note that if the forged shares deviate too much from the original shares 
then the victim will notice the difference and suspect being cheated. Therefore, 
a necessary condition for a cheating activity to be successful is that the forged 
shares must be indistinguishable from the original shares. There are different 
cheating activities defined in [15]. 
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10.3 Cheating Prevention Schemes 

A visual secret sharing scheme is said to be a cheating prevention scheme if the 
probability of successful cheating is negligible. We will not consider cheating 
prevention in computational visual cryptographic schemes [21]. We can divide 
the cheating prevention schemes into two classes. One is based on share au- 
thentication where another share (transparency) is used to authenticate other 
shares (transparencies) and the other is based on blind authentication where 
some property of the image is used to authenticate the reconstructed secret 
image. For example, in [8], it is assumed that a smooth image such that its 
boundary of black and white regions is clearly perceptible is regarded as au- 
thentic. Due to practical reasons, most cheating prevention schemes focus on 
2-out-of-n schemes. In the following subsections, we will survey 6 recent pro- 
posed cheating prevention schemes: two from [8], proposed in 2006 and will 
be referred to as HCT1 and HCT2, one from [15], proposed in 2007 and will 
be referred to as HT, one from [18], proposed in 2007 and will be referred to 
as TCH, and two from [20], proposed in 2009 and will be referred to as PS1 
and PS2. 

10.3.1 HCT1 and HCT2 

In [8], two cheating prevention schemes are proposed: the Authentication 
Based Cheating Prevention scheme , referred to as HCT1, and the 2-out-of- 
( n + l) cheating prevention scheme, referred to as HCT2. HCT1, shown in 
Figure 10.5, is a share-authentication-based cheating prevention scheme and 
HCT2, shown in Figure 10.7, is a blind-authentication-based cheating pre- 
vention scheme. Figure 10.6 shows an experiment of HCT1. In HCT1, each 
participant uses an extra transparency to verify the integrity of other trans- 
parencies by means of the appearance of the verification logo. A participant 
adopts a verification transparency to verify the integrity of other transparen- 
cies through the appearance of his own verification logo. Each verification 
transparency is generated by a 2-out-of-2 VC. Therefore, each participant re- 
ceives two transparencies, namely, secret share transparency and verification 
transparency created by the 2-out-of-n and 2-out-of-2 VC, respectively. Figure 
10.6 shows an experiment of HCT1. 

HCT2 generates (n + l) transparencies but it only delivers n transparencies 
to participants. The probability that cheaters can correctly guess the structure 
of each block generated for a black pixel of the victim’s transparency is down 
to 1/(1 + l). The secret image is redesigned to consist of two complementary 
parts. Two binary images are said to be complementary to each other if and 
only if they have the same size and, for all corresponding pixels, one is black 
and the other is white. Therefore, the probability that cheaters can correctly 
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HCT2. 


guess the structure of victim’s transparency is negligible. The idea can be 
extended to design a fc-out-of-(n + l) cheating prevention scheme. 

10.3.2 HT 

The core of HT, shown in Figure 10.8, uses a generic transformation to create 
new transparencies by adding two subpixels to every block of every original 
transparency. Then, HT creates a verification transparency for each partici- 
pant such that the stacking result of the new transparency with the verifica- 
tion transparency will reveal a verification image. Therefore, HT is a share- 
authentication-based cheating prevention scheme. Basically, HT will perform 
the following steps with input C° and C 1 to create verification transparencies 



' 10 



' 10 


1. Let T 0 — 

10 

c° 

and Ti = 

10 

C 1 


2. Use T° and T 1 as the base matrices for creating transparencies 

3. For each participant Pi , choose a verification image and create a verification 
transparency Uj as follows: 
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HT. 


a. For each white pixel in the verification image, the block of Vi created 
based on [1 0 0 ... 0] (after corresponding permutation as for generating 
the secret shares in step 2). 

b. b For each black pixel in the verification image, the block of Vi created 
based on [0 1 0 ... 0] (after corresponding permutation as for generating 
the secret shares in step 2). 

In the decoding phase of the secret image, before stacking transparencies, each 
Pi checks the stacking result of Vi with Tj held by participant Pj revealing his 
own verification image. Figure 10.9 shows an example of an HT scheme. 


10.3.3 TCH 

In [18], Tsai et al. proposed a cheating prevention scheme, shown in Figure 
10.10, images where shares are generated by Genetic Algorithms. TCH adopts 
multiple secret images with the same visual meaning. Each qualified subset 
only reveals the corresponding reconstructed secret image and the others are 
left unknown to potential cheaters. Any participant accepts the decoding re- 
sult only if the visually reconstructed secret image is authentic. In TCH, the 
fitness function of the Generic Algorithm was designed according to a 2-out- 
of-n visual secret sharing scheme. But, it is not guaranteed that the same 
quality is obtained because the Generic Algorithm is a kind of heuristic al- 
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TCH. 

gorithm. Therefore, the dealer should control the quality of all reconstructed 
secret images before delivering all transparencies. That is, all transparencies 
should be indistinguishable. 

10.3.4 PS1 and PS2 

In 2009, De Prisco and De Santis [20] proposed 2-out-of-n and n-out-of-n 
cheating prevention schemes, as shown in Figure 10.11. They are obtained by 
simply adding an extra column with all Os to the base matrices of the schemes 
of Naor and Shamir. 

In the following, we describe another 2-out-of-n cheating prevention 
scheme, as shown in Figure 10.12 and proposed in the same paper. This scheme 
does not require the use of a complementary image. The base matrices of the 
scheme have dimension nx (2 n + n + 1). The white base matrix C° has the 
following columns: all the possible 2” binary column vectors of length n, one 
additional column with all Is and n additional columns with all 0s. Whereas, 
the black base matrix C 1 has the following columns: all the possible 2 n binary 
column- vectors of length n, one additional column with all 0s in the n columns 
of the identity matrix of dimension n x n. 

The base matrices of a 2-out-of-3 PS2 scheme are shown as follows: 
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We refer the readers to [20] for more details. 
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10.4 Analysis of Cheating Prevention Schemes 

We begin with a general discussion of the advantages and disadvantages of the 
share authentication approach and blind authentication approach. The advan- 
tages of share-authentication-based cheating prevention approach are twofold. 
One is that checking the authenticity of shares is optional. It can be done only 
when someone is suspected of cheating. The other is that the generation of 
verification shares is done after the generation of secret shares. Therefore, any 
conventional visual secret sharing schemes (for any access structures) can be 
turned into a cheating prevention scheme. The quality of the reconstructed se- 
cret image is not affected. The disadvantages of this approach are also twofold. 
One is that additional shares for verification purpose are needed. The other 
is that these schemes lack a formal proof of security. 

The advantages of blind-authentication-based cheating prevention ap- 
proach are twofold. One is that no additional shares are required. The other is 
that we can formally prove the security. We can formally argue that the prob- 
ability of changing a black pixel (or white pixel) by the cheaters is less than 1. 
The disadvantages of this approach are also twofold. One is that this approach 
is only suitable for threshold visual secret sharing schemes. The other is that 
the quality of the reconstructed secret image is degraded. 

The comparisons of different cheating prevention schemes are illustrated 
in Table 10.1. With respect to the total number of subpixels for sharing a 
pixel, TCH requires the least subpixels for sharing a pixel. HCL1 requires 
2 n 2 subpixels, since an extra transparency is used to verify the correctness 
of other transparencies. HT requires 2n(n + 2) subpixels because this scheme 
also needs verification transparencies and each original transparency is en- 
larged. Finally, HCT2 needs 2 (n + l) 2 subpixels. With respect to prevention 
of shares against cheating, the following schemes are all designed according 
to authentic conditions (AC). PS and HT both prevent all blocks of each 
transparency from cheating. HCT1 only prevents these blocks within the 
corresponding verification logo. And HCT2 only prevents blocks that were 
created for presenting black pixels. The share-authentication-based cheating 
prevention approach can be applied to general access structures. Whereas 
blind-authentication-based cheating prevention approach is more suitable for 
threshold access structures, with respect to the method for share generation, 
HT uses a modified VC by the basis matrices T° and T 1 . HCL1 and HCL2 
use the share construction method of traditional VC. Finally, TCH uses GA 
for share generation. With respect to security , all schemes are designed for 
preventing a known secret cheating attack. However, HCL1, HT, and TCH 
are not formally proved to be secure. 
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TABLE 10.1 

Comparisons of different cheating prevention visual secret sharing schemes. 


Scheme 

Approach 

Access stru. 

Share gen. 

subpixels 

Security 

HCL1 

Share auth. 

General 

Base matrices 

2 n' z 


HCL2 

Blind auth. 

fc-out-of-n 

Base matrices 

2(n + l) z 

Secure 

HT 

Share auth. 

fc-out-of-n 

Base matrices 

2 n(n + 2) 


TCH 

Blind auth. 

2-out-of-n 

GA 

ri 2 


PS1 

Blind auth. 

2(n)-out-of-n 

Base matrices 

2(n + l) 2 

Secure 

PS2 

Blind auth. 

2-out-of-n 

Base matrices 

n x (2” + n + l) 

Secure 


10.5 Conclusions 

In this chapter, we have surveyed some cheating prevention schemes in visual 
cryptography and provided a comparative evaluation of their advantages and 
disadvantages. There are many topics that deserve further instigation, for 
example, giving formal definition of cheating and cheating attack models and 
designing new cheating prevention scheme a with less numbers of subpixels 
for sharing a pixel. 
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11.1 Introduction 

The basic principle of the Visual Cryptography Scheme (VCS) was first for- 
mally introduced by Naor and Shamir [10]. The idea of the VCS proposed 
in [10] is to split an image into two random shares (printed on transparen- 
cies), which separately reveal no information about the original secret image 
other than the size of the secret image. The image is composed of black and 
white pixels. The original image can be recovered by stacking the two trans- 
parencies together. 

One important parameter in VCS is pixel expansion, where the pixel ex- 
pansion reflects the size of the recovered secret image. Many papers in the 
literature are dedicated to proposing VCS with smaller pixel expansion. How- 
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ever, all these works are based at the pixel level, i.e. , to reduce the number of 
subpixels that represent a pixel of the original secret image. 

We notice that, the final goal of reducing the pixel expansion is to re- 
duce the size of the transparencies that are distributed to the participants, 
because smaller transparencies are easier to transport. However, the size of 
the subpixels that are printed on the transparencies affects the final size of 
the transparencies; in fact, the size of the transparencies is the product of the 
size of the subpixels and the number of the subpixels in each transparency. 
Unfortunately, there is a dilemma when one tries to determine the size of the 
subpixels: When the subpixel size is large, it is easy to align the shares (most 
publications in the literature require aligning the shares precisely in the de- 
crypting phase), but the large subpixel size will result in large transparencies. 
On the other hand, when the subpixel size is small, it is relatively hard to align 
the shares, but smaller transparencies result. From the point of view of the 
participants of the VCS, the goal is to align the shares easily and have small 
transparencies as well. Table 11.1 shows the relationship between the size of 
the subpixels of the transparencies and the ease to align them (more compar- 
isons will be given in Table 11.5 later). Hence, there is a trade-off between the 
size of the subpixels of the transparencies and the ease to align them. 


TABLE 11.1 

The advantages and disadvantages of large and small subpixels. 


size of the 
subpixels 

advantages 

disadvantages 

larger 

easier to align 

larger transparency size 

smaller 

smaller transparency size 

harder to align 


The usual way of tackling the alignment problem of the VCS is by adding 
frames to the shares. To align the shares one just needs to align the frames. Yan 
et al. [13] employed the Walsh transform to embed marks in both of the shares 
so as to find the alignment position of these shares. However, both methods 
need to align the transparencies precisely. Besides, Kobara and Imai [6] con- 
sidered a different problem. They calculated the visible space when viewing 
the transparencies. The results are somehow related to the alignment prob- 
lem, but not exactly, as [6] has no discussion about alignment at all. Kobara 
and Imai [6] do not consider the stacking of more than two shares. Nakajima 
and Yamaguchi [9] proposed a (2,2), extended VCS, which the secret image 
and shares are natural images. Their scheme can simultaneously reduce the 
alignment difficulty. However, their scheme does not hold the perfect security 
like a secret sharing scheme. 

In fact, the precise alignment of small subpixels is not critical. The secret 
image can still be recovered visually even if the participants do not align the 
transparencies precisely. This phenomenon helps to determine the size of the 
subpixels printed on the transparencies. 

This chapter focuses on some recent results about the alignment problem 
of the visual cryptography scheme [8, 16]. Two kinds of alignment problems 
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of share images are considered. First, the share images are misaligned by 
integer number of subpixels (less than the pixel expansion) . This part mainly 
comes from [8]. In such a case, the secret image can still be observed as 
its complementary image. Second, the share images are misaligned by less 
than one subpixel. This part mainly comes from [16]). Conditions that the 
secret image can still be recovered are studied, and the different misalignment 
tolerances of large and small subpixels are compared. The results indicate 
that the VCS, by itself, has some misalignment tolerance. At last, we provide 
a misalignment tolerant VCS based on the trade-off between the usage of large 
and small subpixels. 


11.2 Preliminaries 

In the VCS, there is a secret image that is encrypted into some shares. The 
secret image is called the original secret image for clarity, and the shares are 
the encrypted images (and are called the transparencies if they are printed). 
When a qualified set of shares (transparencies) are stacked together, it gives 
a visual image that is almost the same as the original secret image, we call it 
the recovered secret image. In the case of black and white images, the original 
secret image is represented as a pattern of black and white pixels. Each of 
these pixels is divided into subpixels, which themselves are encoded as black 
and white to produce the shares. The recovered secret image is also a pattern 
of black and white subpixels that should visually reveal the original secret 
image if a qualified set of shares is stacked. 

In order to simplify the discussion, in this paper, we will only consider the 
black and white VCS, where black pixels are denoted by 1 and white pixels 
are denoted by 0. 

By a (fc,n)-VCS we mean a scheme where the original secret image is 
divided into n shares, which are distributed to n participants. Any subgroup 
of k out of these n participants can get a recovered secret image, but any 
subgroup consisting of less than k participants does not have any information 
other than the size about the original secret image. 

For a vector v £ GF m { 2), we denote by w(v) the Hamming weight of the 
vector v, i.e. , the number of nonzero coordinates in v. A (fc,?i)-VCS, denoted 
by (Co, Ci), consists of two collections of n x m binary matrices Co and Ci. 
To share a white ( resp . black) pixel, a dealer (the one who sets up the system) 
randomly chooses one of the matrices, called a share matrix, in Co {resp. Ci) 
and distributes its rows (representing a pattern of subpixels in the share) to 
the n participants of the scheme, giving row i to participant i, i = 1, • • • , n. 
More precisely, we give a formal definition of the {k, n)-VCS as follows: 

Definition 1 Let k, n, m be nonnegative integers, l and h be positive numbers 
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satisfying 2 < k < n and 0 < l < h < m. The two collections of n x m binary 
matrices ( Cq,C\ ) constitute a visual cryptography scheme ( k,n)-VCS if the 
following properties are satisfied: 

1. ( Contrast ) For any s £ Co, the OR of any k out of n rows of s 
is a vector v that satisfies w(v) < l. 

2. ( Contrast ) For any s £ C\, the OR of any k out of n rows of s 
is a vector v that satisfies w(v) > h. 

3. ( Security ) For any i\ < *2 < ••• < it. in {1, 2, • • • , n} with 
t < k, the two collections oft x m matrices Dj, j = 0, 1, obtained by 
restricting each nxm matrix in Cj, j = 0,1, to rows *i , 12 , ■ ■ ■ it , are 
indistinguishable in the sense that they contain the same matrices 
with the same frequencies. 

Note that, in the above definition, 

1. m is called the block length and determines the pixel expansion of the scheme. 
A pixel of the original secret image is represented by m subpixels in the 
recovered secret image. In general, we are interested in schemes with m 
being as small as possible, h and l are called the darkness thresholds of the 
black and white pixels, respectively. 

2. Define the value a = — - to be the contrast of the scheme. Note that, 

m 1 

however, there are other definitions of the contrast of VCS. We use this 
definition to establish our result. The proof is similar for other definitions 
of contrast. 

We consider VCS in which Co, C\ are constructed from a pair of n x m 
binary matrices M 0 , Mi, called basis matrices. The set Cj, i = 0, 1 consists of 
the ml matrices obtained by applying all permutations to the columns of Mi. 
This approach of VCS construction will have small memory requirements (it 
only keeps the basis matrices) and high efficiency (to choose a matrix in Co 
(resp. Ci) as it only needs to generate a permutation of the basis matrix). We 
will use the basis matrices to simplify the discussions. 

The above definition of VCS is also called the Deterministic Visual Cryp- 
tography Scheme (DVCS). The original secret image can be deterministically 
recovered by the qualified shares pixel by pixel in such schemes. In contrast to 
the DVCS, Yang and Cimato et al. proposed the Probabilistic Visual Cryptog- 
raphy Scheme (PVCS) in [14, 4], where the pixels of the original secret image 
can only be probabilistically recovered by the qualified shares, however, in the 
overall view the original secret image can be recovered visually as well. 

Definition 2 (Probabilistic VCS [14, 4]) Let k, n, and m be nonneg- 
ative integers, l and h be positive numbers, satisfying 2 < k < n and 
0 < l < h < in . The two collections of n x m binary matrices (Co,Ci) 
constitute a probabilistic threshold Visual Cryptography Scheme ( k,n)-PVCS 
if the following properties are satisfied: 
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1. ( Contrast ) For the collection Co and a share matrix s £ Co, by 
v a vector resulting from the OR of any k out of the n rows of s. If 
w(v ) denotes the average of the Hamming weights ofv, over all the 
share matrices in Co, then w(v) < l. 

2. ( Contrast ) For the collection C\, the value of w(v) satisfies 
w(v ) > h. 

3. ( Security ) For any i\ < ii < ••• < it in { 1,2, ••• ,n} with 
t < k, the two collections oftxm matrices Dj, j = 0, 1, obtained by 
restricting each nxm matrix in Cj, j = 0, 1, to rows i\,in, ■ ■ - it, are 
indistinguishable in the sense that they contain the same matrices 
with the same frequencies. 

The definition of PVCS in [14] only considers the case with n x 1 share 
matrices, we extend their definition to the nxm. case. And the definition of 
PVCS in [4] used the factor (3 to reflect the contrast, we use the values J and 
h (darkness grey-levels) to reflect the contrast. The same point of the three 
definitions of PVCS is that, for a particular pixel in the original secret image, 
the qualified participants can only correctly represent it in the recovered secret 
image with a certain probability. Because the human eyes always average the 
high frequency black and white dots into gray areas, so the average value of 
the Hamming weight of the black dots in the area reflects the grayness of the 
area. The PVCS does not require the satisfaction of the difference in grayness 
for each pixel in the recovered secret image as the DVCS does. It only reflects 
the difference in grayness in the overall view. 

The contrast of the DVCS is fulfilled for each pixel (consisting of m sub- 
pixels) in the recovered secret image, however, this is quite different in the 
PVCS. The application of the average contrast, denoted by a, first appeared 
in [3]. This term is often used in the PVCS, see [4, 14, 11, 7], where the 
traditional contrast of the PVCS does not exist. Here we define the average 
contrast to be the average value of the overall contrast of the recovered secret 
image, i.e. , the mean value of the contrast of all the pixels in the recovered 
secret image. According to our definition of the contrast a = , the average 

contrast can be calculated by the formula a = where h and I are the 
mean values of w(v ) for the black and white pixels in the overall recovered 
secret image respectively, and m is the pixel expansion of the PVCS. Because 
the number of pixels is large in the recovered secret image, the values h and 
l are equivalent to the mean values of the w(v) in the collections C\ and Co, 
respectively. Note that, the DVCS also has the average contrast, and many 
proposed DVCS’s in the literature have a = a, see examples in [10, 5, 1], 
etc. When comparing, the DVCS that has a = a then, in the overall view, 
the clearness of the recovered secret image of the PVCS is the same as the 
clearness of the recovered secret image of a DVCS. However, because of the 
probabilistic nature, a PVCS is disadvantaged in displaying the details of the 
original secret image, for example, a thin line in the original secret image is 
likely to be displayed as a dotted line in a PVCS. 
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11.3 Misalignment with Integer Number of Subpixels 

According to the traditional view, the subpixels of the transparencies should 
be aligned precisely. Here, we point out that, to recover the secret image 
visually, it is not necessary to align the subpixels precisely. In this section, we 
will only consider the misalignment with integer number of subpixels. 

We will show that, by shifting one of the shares by some number (at 
most to — 1) of subpixels to the right (resp. left), one can still recover the 
secret image visually, for the reason that the average contrast a / 0. This 
result can naturally be extended to the case when more than one share is 
shifted. However, we leave the numerical analysis of this case to the interested 
readers. So, in this section, we will only consider the case with only one share 
(transparency) being shifted by some number of subpixels. And we call the 
scheme with a share being shifted the shifted scheme, and the basis matrices 
and share matrices of the shifted scheme are called the shifted basis matrices 
and shifted share matrices. 

We first give an example to show this phenomenon. 

Example 1 We take the (2, 2 )-DVCS as an example, where the basis matrices 
of the scheme are, 



<e> 


FIGURE 11.1 

The stacking results of the (2,2)-DVCS (a) when no share is shifted; (b) when 
one share is shifted by one subpixels; (c) when one share is shifted by two 
subpixel. A printed-text ’’CRYPTO” is tested. 


Figure 11.1 are the experimental results of the recovered secret image, 
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where (a) is the recovered secret image without being shifted, and (b) is the 
recovered secret image with the second share being shifted to the left by one 
subpixel, and (c) is the recovered secret image with the second share being 
shifted to the left by 2 subpixels. From the experimental results we notice 
that, the original secret image can be recovered visually by shifting one or two 
subpixels for the (2,2)-DVCS with pixel expansion m = 3. And the clearness 
of the recovered secret image with two subpixels being shifted is not as clear 
as the one with one subpixel being shifted. Furthermore, the shifted scheme 
is not a DVCS anymore; we give an example to show this point: 


Example 2 Take the share matrices S° 


010 

010 


and S 1 


100 

010 


as an 


example, which are chosen from the permutations of the basis matrices M$ 
and Mi in Example 1. By shifting the second share by one subpixel to the left, 
we get the following four matrices: 


S°o = 


* 

0 

010 ' 
100 


* 

0 

010 ' 
101 

cl _ 
°o — 

* 

0 

100 ' 
100 

Sl = 

* 

0 

100 ' 
101 


where Sft i = 0, 1, j = 0,1, is the shifted share matrix that a subpixel j is 
shifted into S z . The left bottom subpixel of S z is shifted out, and the asterisk 
* in the S z can be either 1 or 0, which belongs to the pixel on the left of the 
pixel that we considered. So, here and hereafter, we no longer consider the two 
subpixels anymore, i.e., we only need to consider the right 3 columns in the 
shifted share matrix S z . 

For the above four shifted share matrices, the stacking Hamming weights 
are 2, 3, 1, and 2. In particular, the stacking Hamming weight of S g and 
Sl are the same. Here and hereafter, the stacking Hamming weight means 
the Hamming weight of the resulting vector generated by stacking the shares. 
Hence, the shifted scheme is not a DVCS anymore. 


Generally, we aim at proving the conclusion that, the shifted scheme can 
visually recover the original secret image based on the (fc, ?r)-DVCS. However, 
it is noticed that this proof can be reduced to the proof based on the (2, 2)- 
DVCS in the case that only one share is shifted. The reason is as follows: 

First, a (fc,n)-DVCS consists of (f) (k,k)- DVCS. For a set of k shares, if 
no share is shifted, then the k shares can recover the secret image obviously. 
And because we only consider the case when only one of the n shares is shifted, 
we only need to consider the k shares that contain the shifted share, i.e., we 
only need to prove our conclusion based on a [k, fc)-DVCS. 

Second, denote the k shares of a (k, k )- DVCS as Si, S 2 , • • • , s k , without loss 
of generality, let Sk be the share that is shifted, and let s' k be the resulting 
image of stacking the remaining k — 1 shares Si, S 2 , ■ ■ ■ , Sk-i together. Then 
the scheme becomes a (2, 2)-DVCS, where the two shares are s' k and s k - Note 
that, the stacking result of this (2, 2)-DVCS is the same as that of the previous 
(. k , fc)-DVCS. The previous ( k , fc)-DVCS can visually recover the secret image 
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if and only if s' k and Sk can do so. Hence, it is sufficient to prove the conclusion 
based on a (2, 2)-DVCS. 

We analyze the structure of the basis matrix of the (2, 2)-DVCS. Denote 
Mo and M\ as the basis matrices of the (2,2)-DVCS, then the Mo and Mi, 
without loss of generality, are in the following form: 





abed 


and 





abed 


where a, b, c, d, a , b , c , and d are nonnegative integers satisfying a+c+d = l 
and a+c+d = h. According to the contrast and security property of 
Definition 1, we have, 


! a + b + c + d = a +b + c + d 
a + c = a + c 
a + d = a + d 
b>b' 


solving the above equations, we get a — a’ = b — b' = d — c = d' — d. Let 
e = b — b\ hence, by deleting identical columns of Mq and Mi, we get, 

M' 0 = 

and, 

Mi = 

where the number of columns in M 0 and Mi is 2e. 

Now we know that the basis matrices of an arbitrary (2,2)-DVCS M 0 

and Mi contain the same number of identical columns 

apart from the submatrices M 0 and M 1 . Hence, without loss of 
generality, they can be represented as the following form: 



a' b' c d e e 


and 



1 


0 


1 

o 

1 

1 

1 
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a' b' c d e e 


Let m be the pixel expansion, then it is obvious that m = a' + b' + c + d + 2e. 
The collections Co and C\ contain all the permutations of the basis matrices 
M 0 and Mi, and hence each has to! share matrices. 

The shifted scheme is generated as follows: 

Shift the second row of the m\ share matrices in Co (resp. C\) to the left 
(resp. right) by r subpixels, and let C\,C 2 ,--- ,c r be the r-bit string that is 
shifted in, where each c, € {0,1} represents a subpixel. By the above discus- 
sion, we get m\ shifted share matrices for Cq (resp. Ci). Take the share matrix 

(V) 

Mo £ Cq as an example, then the shifted share matrix, denoted by M ( ) , is 
as follows: 

f *...* 1 ... 10 --- 01 --- 10 --- 01 --- 10---0 1 



a' b' c d e e 


where C\ ■ ■ ■ c r of share 2 are the adjacent subpixels of the right pixel that are 
shifted in. 

By going through all to! share matrices of Co and C\ and all the possible 
string of subpixels Ci • • • c r £ {0, l} r , where {0, l} r is the set of all the binary 
strings of length r, the shifted scheme is generated. Hence, we have: 

Theorem 1 The shifted scheme of a DVCS is a PVCS, where the average 
contrast of the shifted scheme is a = where 1 < r < m — 1 is the 

number of subpixels by which the share 2 (the second share) is shifted. 

Proof: Without loss of generality, we only prove the case when the share 2 is 
shifted to the left, which is equivalent to the case when the share 1 (the first 
share) is shifted to the right. Note that, swapping rows 1 and 2 corresponds to 
swapping the parameters c and d. We observe that, since the share matrices 
of the DVCS satisfy condition 3 of Definition 1 and the shifting operation is 
the same for matrices in Co and C\ , the share matrices of the shifted scheme 
satisfy condition 3 of Definition 2. 

First, we prove the case that the share 2 is shifted by one subpixel, and 
then we extend it to the case when it is shifted by r subpixels. 

When share 2 is shifted by one subpixel, the adjacent right subpixel of 
share 2 is shifted in. Let p\ be the probability that a 1 is shifted in, and po 
be the probability that a 0 is shifted in. Because the share matrices are all 
the permutations of the basis matrices, so pi and po have fixed values and 
Pi +Po = 1, he., the shifted in subpixel is either 1 or 0. More precisely, by the 
above discussion we have pi = a ~}^ +e and po = - + n c l +e ■ In the general case 
when r subpixels are shifted in, denote p c as the probability that a string of 
subpixels c is shifted in, we also have )C c e{o iyPc = 1- 
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Because, under the OR operation, the stacking of two black subpixels 
results in a black subpixel, i.e., 1 OR 1 = 1, so this means that there is a black 
subpixel that is ineffective (overlapped). Now we define a black pixel (value 1) 
to be ineffective if it does not contribute to the total number of black pixels 
in the recovered secret image. There are three cases when a black subpixel 
1 is ineffective: (1) when that is in the top right corner of the matrix Mq 
(or Mi) and another 1 is shifted in, this results in a overlap; (2) when that 
is in the bottom left corner of the matrix which is then shifted out (appear 
below an asterisk “*’); and (3) when an overlap happens after a shift, which is 
possible on the first m — 1 positions (and m — r positions in general). Hence, 
the total Hamming weight of the stacking of the shifted share matrices can 
be calculated by the total number of the l’s subtracted by the number of 
the l’s that are ineffective (when two l’s overlapped, we only count one as 
ineffective) . 

In the first case, denote by sj c and c the number of l’s that are in- 
effective for the collections Co and Cl, respectively when the subpixel c is 
shifted in. Since there are m\ share matrices in the collection Co and Cl, so 
the total number of l’s that are ineffective in the top right corner of all the 
share matrices in Co and Ci is sj i = s* x = a +° +e m! (when a 1 is shifted in) 
and Sq o = s} 0 = 0 ( w h en a 0 is shifted in), where a ~*^ +e is the probability 
of the l’s in the top right corner of the first row. 

In the second case, denote by Sq c and s\ c the number of l’s that are 
ineffective for the collections Co and Ci, respectively when the subpixel c is 
shifted in. So the total number of l’s that are ineffective in the bottom left 
corner of all the share matrices in C 0 and Ci is s\ x = Sq 1 = sf 0 = So o = 
" + 'li +e m\, where a + ^ +e is the probability of the l’s in the bottom left corner 
of the second row. 

In the third case, denote by Sq c and sf c the number of l’s that are ineffec- 
tive for the collections Co and Ci respectively when the subpixel c is shifted 


in. Note that, the pattern 


in the shifted share matrices is the shifted 


result of the following four patterns, 


' 11 ' 


' 10 ' 


' 10 ' 

, and 

' 11 ' 

01 

1 

11 

1 

01 

11 


in 


the collections Co and Ci. We calculate the probability of the first pattern 


11 

01 


for example, and the other three patterns can be calculated similarly. 


The probability that the pattern 


1 

0 


appears at the column i in the matri- 


ces of the collection Ci is and, fixing this pattern, the probability that 
appears at the column i + 1 of the collection Ci is , 


the pattern 


1 


where 1 < * < m — 1. So the probability that the pattern 


11 

01 


appears both 
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at the columns i and i + 1 in the collection C\ is ^ . Similarly, for the 
remaining three patterns, the results are shown in Table 11.2. 


TABLE 11.2 

The probability of the four patterns appearing at the columns i and 
i + 1 in the collections Co and C\ . 


col l ections\patterns 


10 

n 



n 

n 



10 

01 



n 

01 


Ci 


a' d-\-e 



a' a' — 1 


c+e d-\-e 

c+e a' 

m m—1 

m m—1 

m m— 1 

m m—1 

Co 

a +e d 

a ' +e a -\-e— 1 


c d 



c q +e 


m m—1 

m m—1 

m m—1 

m m—1 


The collection Co and C\ contain all the column permutations of the basis 
matrices in all possible ways, and there are only m — 1 choices for the value 
of i, so the total number of l’s that are ineffective of the four patterns of the 
collection C x is a? , = a? n = ( ^ ^ ^ ^ ) (m - l)m! , 

± 1,1 i,u 'mm— 1 mm— 1 m m— 1 m ra— 1 ' v > 1 

a' -\-e q/+e— 1 i c __d_ 


and that of the collection Co is Sq i = Sq o = ( 
^ )(m-l)m!. 


c+e d-\-e 
m— 1 

( q'+e d 


m m— 1 


m — 1 


m m— 1 


Denote the total number of l’s in the share matrices in collections Co and 


Ci plus the number of l’s in the subpixel c that is shifted in as To jC and Xi >c , 
respectively. Then, when a 1 is shifted in, we have T 0 p = Tip = (2 a' + c+d + 
2e+l)m!, and when a 0 is shifted in, we have T 0 0 = T lj0 = (2a , + c+d+2e)m!. 

Denote T Cj c as the total stacking Hamming weight of all the matrices of 
the collection C (Co or Cl) when a string of subpixels c are shifted in. The 
above discussion shows that when a 1 is shifted in, the total stacking Hamming 
weight of all the matrices of the collection Ci is 


Ti.ci 


Tip Sip sfp Sip 

[(2a' + c + d+2e + l) — 

/a / (d+e) - a / (o / — 1) . (c+e)(d+e) . (c+e)a / 

' m m m m 


and that of the collection Cq is 


Ti 


1,C 0 


Top s op s§p Sop 

[(2 a' + c+d + 2e + 1) - 

/ (a'+e)d . (q'+e)(a'+e— 1)) . cd 

k m m m 


a 7 +c+e 

m 

m 


When a 0 is shifted in, the total stacking Hamming weight of the collection 
Ci is, 


T 


o,Ci 


Tl ,0 S L 0 sfo s 
[(2u / -(- c H~ d T 2e) — 

/ a (d-\-e) - a (a — 1) , 

' m ' m ' 


3 

1,0 

a -\-d-\-e 

m 

(c+e)(d+e) 

m 


(c+e)q / 

m 


)]m! 


and that of the collection Cq is 
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Tr 


o,c 0 


T — a 1 _ « 2 _ c 3 

J 0,0 * 0,0 * 0,0 * 0,0 

[(2a' + c+d + 2e) - a ' + ^ +e - 

l (a'+e)d , (a'+e)(a'+e-l)) , cd , e(a'+e) m_| 
v m ' m ' m ' m )\'' ' 


We now define the average stacking Hamming weight of each share ma- 
trix to be the total stacking Hamming weight of all the share matrices being 
divided by the number of the share matrices, i.e., -^4-. Then the difference 
between the average stacking Hamming weight of each share matrix of the 
shifted collections Co and Ci, denoted by Da, is 


Da = (T’i.Ci — Ti t c 0 )pi + (To, Ci — T 0i c 0 )po 


ejpi+Po) 

m 


e 

m 


According to the definition of the average contrast in Section 11.2, with 
h = TyCiPi + ?o,CiPo and l = T 1}Co Pi + T 0yCo Po, we get the value of the 
average contrast a = ^ ^ = -™s . 

Now we consider the general case when the share 2 is shifted by r subpixels. 
For this case there are 2 r possible subpixels that can be shifted in. For example, 
for r = 2, the shifted in strings of subpixels have four cases, 00, 01, 10 and 11. 
Denote by poo> Pm Pw and pu the probabilities of these four cases to happen 
respectively, then we have poo + Pm + Pio + Pu = 1. 

We consider the string of subpixels c, let the Hamming weight of c be s, 
i.e., w(c) = s. The total number of l’s that are ineffective in the top right 
corner of all the share matrices in Co and C\ is sj c = s} c = s ■ a +c+e m!, and 
the total number of l’s that are ineffective in the bottom left corner of all the 
share matrices in Co and C\ is So iC = s\ c = r ■ a + ^ i +e m\. For the third case, 


the pattern 


in the shifted share matrices is the shifted result of the 



’ 1...1 ‘ 


' 1---0 ' 


' 1---0 ' 


‘ 1...1 - 

following four patterns, 

r 

0---1 

5 

r 

i---i 

•> 

r 

0---1 

and 

r 

i---i 


r 


r 


r 


r 


in the collections Co and C\, and there are only m — r choices for the value 
of the position i, so the total number of the l’s that are ineffective of the four 
patterns of the collection C\ is 


a! d + e 
mm — 1 


a! a! — \ 


mm — 1 


c + e d + e 
m m — 1 


c + e a' 
m to — 1 


)(m 


r)m! 


and of the collection Co is 


a' + e d 
to to — 1 


a' + e a' + e — 1 
to to — 1 


c d 
mm — 1 


c a' + e 
to to — 1 


)( m 


r)m! 


Hence, when a string of subpixels of c is shifted in, the total stacking Hamming 
weight of all the matrices of the collection C\ is 


T c ,C! = 


[(2a' + c - 

/ a'(d+e) . 
V m 


- d - K 2 6 - 

a' (a' — 1) 


s) - r 

(c+e)(d+e) 


a' -\-d-\-e 


— S 
(c+e)a 


a/+c+e 


\ m—r i 

dm- lJ 
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and that of the collection Co is 


T c,C 0 = 


[{2a' + c + c?+2e + s) — r ■ 

/ (a'+e)d , (a / +e)(g / +e— 1)) , 

' m m 


a -\-d-\-e _ # q'+c+e 

m m 

cd + 4fM)izr| ra i 

m m ' m— 1 J 


Hence, the difference between the average stacking Hamming weight of each 
share matrix of the shifted collections Co and Cl, denoted by Da, is 


Da — ~ ^i— i,c 0 )Pi—i + • • • + (T 0 ... 0 ,ci ~ ^o— o,c 0 )Po— o 

e(pi...i-| hPo-o) m—r 

m m— 1 

e_ m—r 

m m— 1 

and the average contrast is 

Da e m — r 

a= = 2 T- 

m ?n z to — 1 

Because the shifted scheme is not a DVCS anymore and a ^ 0, let h = 
Ti...i,CiPi..-l + • • • + To-'-o.C'iPo-'-o and l = Ti---i,c 0 Pi---i + • • • + 7b...o,c 0 Po -o, 
then it is known that the shifted scheme is a PVCS. This completes the proof 
of Theorem 1. □ 

Note that, after a shift, the value of the average contrast has a negative 
value a < 0, which means that the recovered secret image is the complemen- 
tary image of the original one, and the absolute value of a reflects how clear 
the image can be viewed visually. 

The above Theorem 1 shows that, to align the transparencies when de- 
crypting the DVCS, one does not need to align the transparencies precisely. 
So, when the participants of a DVCS want to align the transparencies, for ex- 
ample, the transparencies in Example 1, they can first align the transparencies 
precisely in the vertical direction, and then move the second transparencies 
to the right then to the left in the horizontal direction. Then they will get the 
recovered secret image for three times. Furthermore, this phenomenon also 
helps to determine the size of the subpixels printed on the transparencies. 

For other visual cryptography schemes, such as the extended visual cryp- 
tography schemes in [2], the visual cryptography schemes for the general ac- 
cess structures [1] and the color visual cryptography schemes [15, 12], they all 
have the phenomenon stated above. The proof for these visual cryptography 
schemes can be modified from that of Theorem 1. 


11.4 Misalignment with Less Than One Subpixel 

In this section, we do further investigation on misalignment with less than 
one subpixel. We show that the secret image can still be recovered visually 
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by a slight misalignment. We first give an example, a (2,2)-VCS, to show 
this phenomenon. Denote ( d x ,d y ) as the horizontal and vertical misalignment 
deviations from the original position of the subpixel. 

Example 3 The images (a), (b), and (c) in Figure 11.2 show the recovered 
secret image of a (2,2)-VCS for three misalignment deviations, ( d x ,d y ) = 
(0,0), (0.5,0), and (1,2) (unit: subpixel). 



FIGURE 11.2 

Recovered secret images of a (2,2)-VCS for three misalignment deviations (a) 
( d x ,d y ) = (0,0), (b) ( d x ,d y ) = (0.5,0), and (c) (d x ,d y ) = (1,2). 

From Figure 11.2, we can observe that, the clearness of Figure 11.2 (b) is 
worse than the Figure 11.2 (a), and the secret on Figure 11.2 (c) is completely 
invisible. 

Figure 11.2 shows the case that only two shares are superimposed. The 
misalignment problem will become more complex for stacking k shares for 
a (fc, n)-VCS. Note that, the recovered image will disappear if any one out 
of k shares is not at the correct position. In fact the misalignment problem 
critically increases as k grows. 

The next two subsections are organized as follows: first, we will investigate 
the conditions that the secret image can still be observed when the shares are 
slightly misaligned, whereby saying slight misalignment we mean deviation 
( d x ,d y ) satisfying 0 < d x ,d y < 1; and then we will investigate the misalign- 
ment tolerance of large and small pixels. To simplify the discussion, we only 
consider the case of (2,2)-VCS. 

11.4.1 Shares with Slightly Misalignment Can Still Recover 
the Secret Image 

We consider a (2,2)-VCS with deviation (d x ,d y ), where a pixel 1W1B (resp. 
1B1W) represents a white pixel that contains a white (resp. black) and a 
black (resp. white) subpixel; and a pixel 2B0W represents a black pixel that 
contains two black subpixels. All possible four cases, (al), (a2), (61), and (62), 
of stacked shares with deviation ( d Xl d y ) are shown in Figure 11.3. The stacked 
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results in Figure 11.3 are marked with red boxes. As shown in Figure 11.3, 
the stacked result is divided into eight parts. Denote A i, A^- A 3 , A 4 , A{, A ' 2 , 
A 3 , and A 4 as the areas of the eight parts respectively, and they satisfy the 
following equations. 


At Aj d x d y 

A 2 A 2 (s d x )dy 

A 3 = A 3 = d x (s — dy) ( 11 . 1 ) 

A 4 = A 4 = (s — d x )(s — dy) 

Ai 4- A 2 4- A 3 + A 4 = s 2 



(al) 


(W or B) 


(IWIBorlBIW) 



(W or B) | 


A' A,' 



( bl) 


(W or B) 


(IWIBorlBIW) 



A 2 


A' 


(a2) 


(Wor B) 

dx 

(IWIBc 

jrlBIW) 

A, 

(WorB) 

BBP 


( b2) 


FIGURE 11.3 

Stacked results of white pixels (al: 1W1B+1W1B, a2: 1B1W+1B1 W) and 
black pixels (bl: 1W1B+1B1W, b2: 1B1W+1W1B) for the same deviation 
(d x ,d y ). 

Denote s x s as the size of a subpixel, and denote Ac, c as the area in the 
stacked results with color C G {IF, B} for case c G (al), (a2), (bl), and (62). 
Note that, some areas are not deterministic in Figure 11.3, for example the 
area Ai in Figure 11.3 (al) belongs to the adjacent pixel on the top left. It can 
be either black or white with equal probability 50%. We introduce a symbol 
P(A) to denote it, i.e., P(A) is the area of A to be either black or white with 
equal probability 50%. Furthermore, we denote P(Ai, A 2 ) as the area that is 
either Ai or A 2 with equal probability 50% since there exist such cases that 
one of two areas is black and the other is white, for example the areas A\ or 
A 2 in Figure 11.3 (a2). The symbols P(A) and P(A\ . A 2 ) satisfy the following 
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equations: 

min{P(A)} = 0 
max{P(A)} = A 
P(A) = A/2 

min{P(Ai, A 2 )} = min{Ai, A 2 } 
max{P(A 1 , A 2 )} = ma x{A 1; A 2 } 
P(A i, A 2 ) = A\/2 + A 2 / 2 


( 11 . 2 ) 


According to Figure 11.3, it is easy to verify the following equations: 


Aw,ai = P{A i) + P(A 2 ) + P(A 3 ) + A 4 

As,ai = P{A 1 ) + P(A 2 ) + P(A 3 ) + A 3 + A 2 + A 3 + 

Aw,a 2 = P(A 3 , A 2 ) + A 4 

Ab,o ,2 = Ai + A 2 + A 3 + A 4 + P(A' 1) A 2 ) + A 3 

Aw, 6 i = -P(A 3 + A 2 ) + A 3 

A_b, 6 i = A x + A 2 + A 3 + A 4 + P(A' + Aj) + A 4 

Aw , 62 = P(A 1 ) + P(A 2 ) + P(A 3 ) 

A_b, 62 = P(Ai) + P(A 2 ) + P(A 3 ) + A 4 + A 3 + A 2 + A 3 + A 4 


The following Theorem 2 shows that the stacked shares with slight mis- 
alignment can still recover the secret image. Note that, by saying the secret 
image is recovered by its original color, we mean that a black (resp. white) 
pixel in the secret image is represented by a black (resp. white) pixel in the 
recovered secret image; and by saying the secret image is recovered by its 
complementary color, we mean that a black (resp. white) pixel in the secret 
image is represented by a white (resp. black) pixel in the recovered secret im- 
age. In order to consist with Definition 1 and Definition 2, we generalize the 
definition of contrast a and average contrast a as follows: 


h-l , _ h — l 
a = ^ andi> =^- 


(11.4) 


where 2 s 2 is the area of a pixel (including two subpixels) and the definitions 
of /i, l , /i, and l are the same as that in Definition 1 and Definition 2. 


Theorem 2 For a misaligned (2,2 )-VCS, denote ( d x ,d y ) as the deviation of 
the stacked shares, then the secret image can still be recovered if (d x ,d y ) falls 
in the regions of R±, R 2 , and P 3 in Figure ll.f, where the properties of the 
misaligned scheme are shown in Table 11.3. 

Proof: Denote l}/f ack area (resp. h% a ckarea ) as the maximum (resp. minimum) 
black area of a white (resp. black) pixel, denote V^ acka rea (resp. h% ackarea ) as 
the average black area of a white (resp. black) pixel, denote h^ h itearea (resp. 
^whitearea) as the minimum (resp. maximum) white area of a black (resp. 
white) pixel, denote h^ Hitearea (resp. T^ hitearea ) as the average white area of 
a black (resp. white) pixel. According to Figure 11.3, we have: 
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FIGURE 11.4 

The regions of deviation (d x ,d y ) that can recover the secret image. 


TABLE 11.3 

The properties of the misaligned schemes. 


regions 

Ri 

R.2 

r 3 

( d x i d y ) 
satisfy 

(s — d x )(s — d y ) 

> s 2 / 2 

0 < d x , d y < s 

0 <d x < 2s/3 

0 < dy < s 

2s/3 < d x < s 

0 < d y < s 

misaligned 

scheme 

DVCS 

PVCS 

DVCS 

contrast 

OLR i = 

s 2 — 2(d x +dy)s-\-2d x d y 

2»2 

&R 2 = 

(2 s 3 d x ) (s dy ) 

4 7* 

a Rs = 

(3 d x 2s) (s dy ) 

47* 

recovered 
secret image 

original 

color 

original 

color 

compl ementary 
color 
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l black area the maximum value of the black area for a white pixel, which 

contains two cases (al) and (a2), i.e., 


iz 


black area 


m&x{A Ba i, A Bta z} 

max{P(Ai) + P(A2) + P(A 3 ) + A } + A (, + A 3 + A 4, 
A\ + A2 + A3 + A4 + P(A}, A2) + A3} 

Ai + A2 + A3 + A4+ 

max{P(Ai) + P(A 2 ) + P(A 3 ), P(A , 1 , Aj) + A3} 

Ai + A2 + A3 + A4 + Ai + A2 + A3 
s 2 + Ai + A 2 + A 3 
2s 2 - A 4 


(11.5) 

h B lack area the minimum value of the black area for a black pixel, which 
contains two cases (61) and (62), i.e., 


h black area min-fAfj^l , A B ,62} ^ p A 4 (11.6) 

luackarea the average black area for a white pixel, which contains two 
cases (al) and (a2), i.e., 


jw 

1 black area 


2 


black area 


— \ [(P(Ai) + P(A2) + P(A 3 ) + A} + A' 2 + A3 + A4) 

+(Ai + A2 +_A 3 + A4-+ P(A}, A2) + A3)] (11.7) 

= \ [(P(Ai) + P(A 2 ) + P(A 3 ) + A} + A' 2 + A3 + A4) 

+(Ai + A2 + A3 + A4 + P( A} , A 2 ) + A3)] 

= s 2 + ^ + ^ + ^ 

is the average black area for a black pixel, which contains two 


cases (61) and (62), i.e., 


iB, 61 


°black area 


i B,62 2 

= S 


Ai A 2 
2 2 


A 3 


A 4 


( 11 . 8 ) 


' B 


white area the minimum value of the white area for a black pixel, which 
contains two cases (61) and (62), i.e., 

= imn{ Aw, bi, Aw, b 2 } = 0 (11.9) 


h B 


white area 


l^white area is the maximum value of the black area for a white pixel, which 
contains two cases (al) and (a2), i.e., 

l w hitearea = max{A,y >a i, A w , a2 } = S 2 (11.10) 

h B hite area i s the average white area for a black pixel, which contains two 
cases (61) and (62), i.e., 


h B 


A 


W,bl 


A 


hite 


W,b2 



(li.ii) 
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l^hitearea the average white area for a white pixel, which contains two 
cases (al) and (o2), i.e. , 


T w 

''white area 


A 


W,al 


A 


W,a2 


A! 

2 


A 2 
2 


^3 

4 


A d 


( 11 . 12 ) 


According to Definition 1 (definition of a deterministic VCS), in order to 
deterministically recover the secret image by its original color, the values of 

l Uackarea and h black area should satis fy l black area < Klackarea ■ Together with 

Equations (11-1), (11.5), and (11.6), we get ( d x , d y ) to satisfy (s—d x )(s—d y ) > 
s 2 / 2, i.e., ( d x ,d y ) falls in the region R\. And the contrast a is 


<A Rj = 


h B - l w 

0 black area u blackarea 

2 s 2 


s“ — 2 (d x d y )s 2 d x d y 

2^ 


Similarly, in order to recover deterministically by its complementary color, 
the values of h B hitearea and C hitearea should satisfy h B hitearea >C hitearea - 

> 


However, according to Equations (11.9) and (11.10), we get that h 


w 

white area 


white area 


does not hold. Hence, the secret image cannot be recovered deter- 


ministically by its complementary color. 

According to Definition 2 (definition of a probabilistic VCS), in order 
to probabilistically recover the secret image by its original color, the val- 
ues ° f klackarea and ^black area sh ° U l d Satisfy I$ ack area < hblack area' To- 
gether with Equations (11.1), (11.7), and (11.8), we get ( d x ,d y ) to satisfy 
0 < d x < 2s/3, 0 < d y < s. By excluding the region R\ we get to know that 
( d x , dy) falls in the region i? 2 - And the contrast q.r 2 is 


ccr 2 = 


hblack area ^ack area _ (^ S 3d x )(s d y ) 


2 S 2 


4 s 2 


Similarly, in order to probabilistically recover the secret image by its 
complementary color, the values of h B earea and W hltearea should satisfy 


h white area > Chitearea- Together with Equations (11.1), (11.11), and (11.12), 
we get ( d x ,d y ) to satisfy 2s/3 < d x < s, 0 < d y < s, i.e. (d x ,d v ) fall in the 
region R$. And the contrast oir 3 is 


= 


h B - l w 

black area black area 

2 s 2 


(3 d x - 2s) (s - d v ) 
4s 2 


□ 


The above Theorem 2 is consistent with Theorem 1. According to The- 
orem 1 and Theorem 2, for the deviation ( d x ,d y ) = (s, 0), the secret image 
can be probabilistically recovered by its complementary color with average 
contrast a — 1/4. 

The above Theorem 2 considers the deviations ( d x ,d y ) less than one sub- 
pixel. In fact, when the value of d x is between s and 2s for a misaligned 
(2, 2)-VCS, the secret image can also be recovered. The proof is left to the 
interested readers. 
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11.4.2 Large Subpixels Have Better Misalignment Tolerance 

In this subsection, we investigate the misalignment tolerance of the large and 
small subpixels. And show that shares with large subpixels have better mis- 
alignment tolerance when recovering the secret image by its original color than 
that with small subpixels. Denote the size of the large and small subpixels as 
S 2 x S 2 and si x si respectively, where S 2 > Si- According to Figure 11.5, 
the recovered secret image using the small subpixels (Figure 11.5(a)) has a 
higher resolution than that using the large subpixels (Figure 11.5(c)). It is ob- 
served that Figure 11.5(a) indeed has the refined resolution in detail of Lena 
image. We can clearly view the hair in Figure 11.5(a) but the area of hair is 
all black in Figure 11.5(c). The image quality using the medium-sized sub- 
pixel (Figure 11.5(b)) is between Figure 11.5(a) and Figure 11.5(c). Although 
using large subpixels in share has poorer resolution, it will be more robust 
to the misalignment error. Next, the misalignment tolerance of different-sized 
subpixels is formally analyzed. 



FIGURE 11.5 

Recovered Lena images for (2,2)-VCS using the different sized subpixels: (a) 
the small-sized subpixel, (b) the medium-sized subpixel and (c) the large-sized 
subpixel. 


Consider a misalignment deviation (d x ,d y ) in the (2, 2)-VCS. All the pos- 
sible cases of stacked shares of a white secret pixel (1B1W) and a black secret 
pixel (2B0W) with a deviation ( d Xl d y ) are shown in Figure 11.3. For the small 
subpixel (si x si), we define the whiteness Rw,ai (resp. Rw,a 2 ) as the ratio 
of black area in a stacked two-subpixel area for the case al (resp. a2) in Fig- 
ure 11.3, and the darkness Rs,bi (resp. Rs,b2) as the ratio of the black area 
in a stacked two-subpixel area for the case b 1 (resp. 62) in Figure 11.3. For 
the large subpixel (S 2 x S 2 ), the corresponding denotations are R[y ai , R'w a 2 > 
^B,b 1 an d ^B,b2' 

To simplify the discussion, we only consider the one dimension deviation, 
i.e. , (d x , 0) or (0 ,d y ). Then we have the following one-dimensional deviation 
lemma. 
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Lemma 3 (One-dimensional deviation) The darkness and the whiteness 
ratios always satisfy R' WaA > Rw, al, R'w,a2 > Rw,a2 R' B ,b 1 ^ Rbm and 
R'b b 2 — RB,b 2 for the deviations (d x ,0) and (0 ,d y ) where 0 < d Xl d y < S\. 

Proof: We only consider the case with deviation (d x , 0) since the proof is the 
same for the case with deviation (0 ,d y ). According to equation (11.1), when 
d y = 0, we have 


A ± =A[= 0 
A 2 =A ! 2 = 0 

A 3 = A ' 3 = d x s (11.13) 

A 4 = A 4 = (s — d x )s 
A 3 + A 4 = s 2 

We consider the relation of Rg, c and Rg c f° r C £ {W,B} and c £ (al), 
(a2), (61) and (62). Recall that si < s 2 , and Rg yC and R' C c can be calculated 
by the following formula: 


Rc, c = 


Aq,c 

2 s 2 


and R' c c = 


Ag,c 

~2*r 


We have Table 11.4 to show the relation of Rg x 
values of C and c. 


(11.14) 


and R'c c for different 


TABLE 11.4 


The relation of the ratios Rg,c and R! r r 


Stacked 

pixel 

Area (A c , c ) 

Ratio ( Rq c ) 

Ratio ( R' c c ) 

Relation 

White, al 

Aw, a 1 = A4 

D Sl—cL x 

K W,al ~ 2 s , 

Df _ S2~d x 

-Hw,al — 2s 9 

R W,al > ^ W,al 

Aw, a 1 = A3 
+A4 

Rw,a 1 = 1/2 

R'w,al = V 2 

Rw,a 1 = Rw,al 

White, a2 

Aw, a 2 = A' a 

R W ,a2 = 

E >/ _ S2~d x 

ri W,a 2 ~ 2 so 

R\V,a2 ^ R\V,a2 

Black, bl 

As,bi = A 3 

-\~A-4 + A ^ 

Rbm = 1 - ^ 

TDf 1 d x 

1X W,al ~ x 2s 2 

R B,bl ,bl 

Black, b2 

Ab, b2 = A4 

Rbm = 1 - 

Dt 1 d x 

IX W,a 2 ~ 1 2s 2 

R'bm > Rbm 

As,b2 = A 3 + 

A4 + A'e^ + A 4 

R B ,b2 = 1 

0/ 1 

ri W,a 2 ~ 1 

R B,b2 = ^ B,b2 


The proofs of the relations in Table 11.4 are quite similar. We only take 
the proof of the relation between R' Wal and Rw,ai > for example. 

According to equation (11.3), for the stacked pixel of Figure 11.3 (al), 
there are two cases of Aw, a 1 , i.e., I: Aw,ai = A 4 and II: Aw, a 1 = A 3 + A4. 

For the Case I, we have R w ,ai = = 4% = and R w,ai = 

by subtraction we have R' WoA - R w ,ai = ~ > °> Le - 

Rw,al ^ Rw,al- 

2 2 

For the Case II, we have R' Wal -R w , a i = ^ = 0, i.e. R' Wal = R\v,ai ■ 

According to Table 11.4, the lemma follows. □ 
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According to Lemma 3, for one-dimensional deviation, it is evident that if 
R! w > R\y and R' B > Rb, the whiteness of the white secret pixel is whiter 
and the darkness of the black secret pixel is darker when using the large 
subpixels. We can conclude that the large subpixels have better misalignment 
tolerance than that of small subpixels. Actually, for two-dimensional deviation, 
the conclusion also holds. However, the proof is rather complex; we omit the 
proof here. Readers also can reach this conclusion via simulations, for example 
the Figure 11.6, and more simulations for two-dimensional deviation can be 
found in [16]. 



FIGURE 11.6 

Recovered secret image for a (2,2)-VCS using two different-sized subpixels 
and ( d x ,d y ) = (0.5, 0.5), (S 1 /S 2 ) = 2: (a) the small subpixel and (b) the large 
subpixel; two secret image (a printed text ” VSS” and a halftoned Lena image) 
are tested. 

From the preceding description and the results in Figure 11.5 and Fig- 
ure 11.6, unfortunately, there exists another dilemma of using the large or 
small subpixels. Together with previous comparisons in Table 11.1, we sum- 
marize the advantages and disadvantages of large and small subpixels in 
Table 11.5. 

In order to bring these conflicting goals in a kind of balance, we prop- 
erly distribute two-sized subpixels in shares to develop their specialities and 
simultaneously avoid corresponding disadvantages. Our method is based on 
the trade-off between the usage of large and small subpixels. Both two-sized 
subpixels create a trade-off, which a large size subpixel leads to the high mis- 
alignment tolerance but the low resolution, while the small subpixel has the 
opposite properties. Finally, we successfully reduce the difficulty of aligning 
shares. Designing our misalignment tolerant VCS therefore delivers the fol- 
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TABLE 11.5 

The advantages and disadvantages of large and small subpixels. 


size of the 
subpixels 

advantages 

disadvantages 

larger 

easier to align and 
better misalignment 
tolerance 

larger transparency size 
and lower resolution 

smaller 

smaller transparency size 
and higher resolution 

harder to align and 
worse misalignment 
tolerance 


lowing problems: (1) What is the appropriate percentage of the large subpixel 
in a share? (2) What is the appropriate size ratio of the large subpixel to the 
small subpixel? (3) How do we arrange the large and small subpixels in one 
share? 


11.5 A Misalignment Tolerant VCS 
11.5.1 The Algorithm 

Concerning the first two problems, both items (the percentage and the size 
ratio) can be used to trade the quality of the recovered secret image for the 
misalignment tolerance. Different percentages and size ratios will be experi- 
mented and analyzed in Section 11.5.2. Consider the third problem, how to 
arrange the large and small subpixels in one share. In this chapter, we ar- 
range them in a regular mask or a random mask. Subsequently, we describe 
the encrypting/decrypting algorithm of a (fc, n)-threshold misalignment toler- 
ant VCS, when given a percentage (the item in Problem (1)), a size ratio (the 
item in Problem 2) and an arrangement mask (the item in problem (3)). 
Notation Used: 

/ A gray secret image of size x x y. 

7 2 The size ratio of a large to a small subpixel, i.e., y 2 = (S 2 /S 1 ) 2 . 

Is A small-scaled secret image of size xxy. This image is obtained by 
halftoning I into a binary image. Note that, this image is used for 
embedding small subpixels. 

Ib A large-scaled secret image of size (x/y) x (y/ y). This image is 
obtained by reducing the secret image / to size (x/y) x (y/y) and 
then halftoning to a binary image. Note that, this image is used for 
embedding large subpixels. 

Pb(ps) Pb and ps are percentages of large and small subpixels, respectively. 
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M, 


reg 


M r , 


A regular mask of size (x/7) x (y/ 7). This mask is only designed 
for pb = ps = 50%. Figure 11.7(a) shows the regular mask with 
the alternate blocks, B and S , where a block B contains large 


subpixels and a block [Sj contains small subpixels. 

A random mask of size (x/j) x (y / 7). This mask is designed for any 
Pb and p$- At this time, B and S are randomly chosen according 


Pb and ps, as shown in Figure 11.7(b). 


Db(-) 


Ds(-) 


A n 


,(') 


0(0 

r 


Let A = [a, j] , where a. ( J is the element of the *-th row and j-th 
column in A, be a matrix in C\ or Cq. The function Db(-) divides 
a secret pixel s into m large subpixels (bp)t ( (bp)t = 0 denotes 
white and (bp)* = 1 denotes black) in the i-tli share, 1 < i < n and 
1 < j < ?n, defined as follows: 

„ . . ( (bp)* = a, . in A € C 0 for s is the white secret pixel. 

v ; ( (bp) l j = a-ij in A e C\ for s is the black secret pixel. 

Similar to Db(-), it divides a secret pixel into m small subpixels 
(sp)* in the *-th share, 1 < i < n and 1 < j < to. 

Arrangement function that randomly arranges in large (or small) 
subpixels into an (m x x m y )-sized rectangle where m = m x x m y . 

n output shares, i £ [l,n], of size (x x m x ) x (y x m y ). 

The recovered secret image of size (x x m x ) x (y x m y ). 



FIGURE 11.7 

Regular and random masks for arranging the large and small subpixels: (a) 
regular mask and (b) random mask. 

Even though the shares use a regular mask, an attacker could not gain any 
information from the mask and the secrecy is not compromised. 

Encrypting Algorithm: 

Input: /, 7 2 , ps, Ps, Cq and C\ of a (k, n)-thresholcl VCS. 

Output: C>(0, i £ [l,n]. 

Step 1: Obtain the large-scaled and small-scaled secret images Is and Is 
from a secret image I. 
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Step 2: Use pb and ps to generate the M ran mask or choose the M reg mask 
for the case ps = Ps = 50%; let the chosen mask M = M ran or 
M reg . 

Step 3: For each block in the mask M, do the following: 


Step 3-1: 


Step 3-2: 


If the block is the large block B , for the secret pixel ”s” in 
the corresponding block of the large-scaled image Is, do the 
following: 

Assign (bp) 1 , = Db{s) for i £ [l,n] and j £ [1 ,m\; 


Use A mximy ((6p)*) to create n (m x x m y )-sized rectangles, 
where m = m x x m y , and deliver them in the corresponding 
block to 0^\ . ., 0^ n \ respectively. 


If the block is the large block S , for the secret pixel ”s” in 


the corresponding block of the large-scaled image Is, do the 
following: 

Assign ( bp )* = Dg(s) for i £ [1 ,n\ and j £ [1 , to]; 


Use A mx:my ((sp)j) to create n (m x x m y )- sized rectangles, 
where m = m x x m y , and deliver them in the corresponding 
block to 0^\ C )( 2 \. . ., 0^ n \ respectively. 


Decrypting Algorithm: 

Input: Any k shares from 0^ l \ i £ [l,n]. 

Output: I'. 

Step 1: Print out k shares on transparencies. Stack and align them by hand 
with the approximate accuracy. 

/* Note that, when stacking shares the tradition VCS needs the pre- 
cise alignment; the proposed scheme has the misalignment tolerance 
and so that one just aligns them roughly. */ 

Step 2: Decrypt the secret directly by human eyes. 

Step 3: Align shares gradually to get a refined secret image of I'. 

/* One can first align transparencies precisely in the vertical direc- 
tion, and then move gradually by hand without losing the secret in 
the horizontal direction, finally the recovered secret image with no 
deviation can be obtained.*/ 

For easily understanding the encrypting algorithm, we herein give an ex- 
ample to show how to encode a secret image. 


Example 4 Construct two shares by the (2, 2) misalignment tolerant VCS, 
where pb = Ps = 50%, y 2 = 4, and AI reg are used. We use a 16 x 16 -pixel 
secret image I, one black horizontal on a white background (Figure 11.8). 

Since I is black and white now, so Is = I, and Ib has the size of 8x8 pixels 
shown in Figure 11.8(a) and (b). By using M reg (Figure 11.7(a)), we encrypt 
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the first pixel in Ib, which is a white secret pixel. Suppose the white pixel is 
divided into two subpixels (■□) in the first share OV\ and the corresponding 
two subpixels in the second share are also (■□). Subsequently, encrypt 
four small secret pixel in Is (see Figure 11.8(c)), these four white secret pixels 


□□ 

□□ 


are respectively encrypted into 


■□□I 

□■□I 


and 


■□□I 

□■□I 


0^1 and OC\ According to the M reg mask, encrypt all secret pixels in 
and Is- Finally, we obtain two shares O VI and O ^ of 32 x 16 pixels. 


in 

Ib 



Encrypt a 16 x 16-pixel secret image by using a (2, 2) misalignment VCS, 
where Pb = Ps = 50%, y 2 = 4, and M reg are used: (a) the small-scaled secret 
image Is, (b) the large-scaled secret image Ib, and (c) two shares and 
0 ( 2 ). 


11.5.2 Simulations 

In this section, we give some simulations to show the performance of the 
misalignment tolerant VCS for different deviations, size ratios, percentages, 
and masks. Example 5 uses fifty-fifty large and small subpixels with regular 
and random masks, respectively, such that we can try out the performance 
of the mask. In Example 6, we use different size ratios to study how the size 
ratio affects the visual quality and the misalignment tolerance. 

Example 5 Construct the (2,2) misalignment tolerant VCS, where pb = 
Ps = 50% and y 2 = 16. Regular mask M reg and random mask M ran are 
tested, respectively. The printed-text ”VSS” is used as a secret image. 
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FIGURE 11.9 

Recovered secret images for a (2, 2) misalignment VCS using two-sized subpix- 
els of 7 2 = 16: (a) p B = 0%, (b) p B = p s = 50%, M reg , (c) p B = p s = 50%, 
M ran and (d) p B = 100%, horizontal deviations: 0, 0.5, 1, and 2 are tested 
(unit: small subpixel). 
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Use the deviations (0,0), (0.5,0), (1,0), (1-5,0) and (2,0) to test the 
misalignment tolerance of the following four schemes: (a ) pb = 0%, (b) 
Pb = PS = 50%, M reg , (c) p B = p s = 50%, M ran and (d) p B = 100%. 
Notice that (a) and (d) are just the traditional VCS with all small subpix- 
els and large subpixels, respectively. The first scheme has the best resolution 
when aligning correctly, as shown in Figure 11.9 (al), but the secret on the 
recovered secret image diminishes quickly when the deviation increases. The 
secret becomes invisible when the deviation is large enough (see Figure 11.9 
(a5)). Comparing Figure 11.9 (a) and (d), the small subpixel gives the high 
resolution (see Figure 11.9 (al) and (dl)), whereas the large subpixel enhances 
the misalignment tolerance. For example, the deviation is ( d x , d y ) = (2, 0), the 
secret in Figure 11.9 (a5) becomes invisible but we still visually view the secret 
”VSS” in Figure 11.9 (d5). As shown in Figure 11.9 (a3) and (a4), the secret 
image is recovered by its complementary color. This interesting phenomenon 
is compatible with the result in Section 11.3 and Section 11.4. From these 
stacked results, our two-sized subpixel approach actually provides the mis- 
alignment tolerance. Also, it is observed that Figure 11.9 (b) ( M reg ) has the 
better visual quality than Figure 11.9 (c) ( M ran ). This result is anticipated 
because the random arrangement of subpixels will introduce additional noise 
to the recovered secret image. 

Example 6 Consider the first scheme in Example 5 (a (2,2) misalignment 
tolerant VCS that the large and small subpixels are half used, respectively, 
and regularly arranged in a share). Three size ratios, q 2 = 4, 16, and 64, are 
tested. The printed-text ” VSS” is used as a secret image. 



FIGURE 11.10 

Recovered secret images for a (2,2) misalignment tolerant VCS using p B = 
Ps = 50%, M reg and three size ratios: (a) y 2 = 4, (b) q 2 = 16 and (c) y 2 = 64, 
horizontal deviations: 0, 0.5, 1, 1.5, 2, 2.5, 3, and 3.5 are tested (unit: small 
subpixel) . 
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Figure 11.10 (a-c) reveal the recovered secret images for y 2 = 4, 16, and 
64, respectively. The clearness of the recovered secret image diminishes when 
the misalignment increases. The misalignment tolerant VCS using y 2 = 64 
has the best misalignment tolerant capability, whereas it has the worst visual 
quality for no deviation. On the contrary, the misalignment tolerant VCS 
using y 2 = 4 has a different characteristic. We may trade the misalignment 
tolerance for the image quality by the size ratio. 


11.6 Conclusions and Discussions 

This chapter is intended to show some recent results about the alignment 
problem of the VCS. We considered two kinds of misalignment, (1) misalign- 
ment with integer number of subpixels and (2) misalignment with less than 
one subpixel. In both cases, the secret image can be visually recovered. This 
phenomenon indicates that, the VCS, by itself, has some misalignment toler- 
ance. 

Then we compared the misalignment tolerance of large and small subpix- 
els, and showed that the large subpixel had better misalignment tolerance. 
Based on this result, a misalignment tolerant VCS was given that traded the 
large and small subpixels in one share. Simulations were provided to show the 
performance of the misalignment tolerant VCS. 

Because of the page limit, we cannot introduce more misalignment toler- 
ant VCS. Interested readers can find more information about the alignment 
problem of the VCS in the following papers [8, 16, 13, 6, 9]. 
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12.1 Introduction 

Naor and Pinkas in their seminal paper [13] suggested to use visual cryptogra- 
phy in a transparency-on-screen version. Their main purpose was authentica- 
tion, in the sense that an online server is able to authenticate itself to a user 
sitting in front of the screen. Implicitly, this already suggests the following 
application of visual cryptography to the problem of manipulation of online 
transactions, like online money transfers, by trojans: 

Main Method. In order to secure online transactions, like online money 
transfers, the user gets a numbered set of transparencies, each with a visual 
cryptography pattern printed on it, from the transaction server. Now the 
user is able to command online transactions in a secure way, see Figure 12.1 
as follows. He fills out an online form containing the data for the intended 
transaction; in the case of a money transfer this would be the account number 
and bank number of the destination bank account and the amount of the 
money. This transaction data is submitted via Internet to the server. The 
server does not execute the transaction immediately because in that case it 

329 
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FIGURE 12.1 

(a) The bank sends the information to be confirmed in an encrypted image to 
the user’s computer and (b) the user is able read this information using the 
transparency he got from the bank. 
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FIGURE 12.2 

A man- in-the- middle manipulation attack by a trojan on an online money 
transfer. 


would be an easy task for a man-in-the-middle to manipulate the transaction: 
the man-in-the-middle would just send his manipulated transaction to the 
server. In order to prevent such a manipulation, the server sends a visual 
message containing the transaction data to the user’s screen - but of course 
this image is not sent openly but instead it is encoded via visual cryptography: 
if the user puts the transparency with a certain number on top of the encoded 
image on the screen he can see the message contained within the image, i.e. , the 
transaction data. Note that the image on the screen is random to a man-in- 
the-Middle, as this a guaranteed by visual cryptography. The number of the 
transparency requested to be used is shown by the server on the user’s screen 
together with the secret image. In order to finally confirm the transaction the 
user types a transaction number (TAN), which is additionally shown on the 
secret image message from the server, into a form on the screen and submits 
this TAN to the server. When the server receives the right TAN it executes 
the transaction, otherwise not. 

Why does this method protect the transaction from being manipulated 
by a man-in-the-middle (which may be, for example, a trojan sitting on the 
user’s PC)? Because a man-in-the-middle does not know the transparencies 
the user got from the server, the man-in-the-middle is not able to manipulate 
the image message sent from the server to the user. In other words, the user will 
see the transaction that is planned to be executed by the server and will only 
confirm such a transaction — a clandestine manipulation of the transaction by 
the trojan is impossible. 
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FIGURE 12.3 

The main method is also applicable to mobile banking. 


In the original purpose of secret sharing in [14] , the order of the slides was 
not relevant. Later work [15] showed that a better contrast can be achieved 
with colors if the first slide can have non-transparent colors. Furthermore, 
practical applications will work in the way that the (first) slide is sent first 
from Alice to Bob over a secure channel (i.e. , by surface mail) and used later 
as a key to decrypt an image received over an insecure channel. 

We regard visual cryptography as a special case of the Cardano grille, 
which works on pixels instead of letters. In both cases we can describe the slide 
(grille) as a 2-dimensional array over {0, 1}, where 0 stands for ’’transparent” 
and 1 for ’’black.” We describe the encrypted image as a 2-dimensional array 
over E = {0,1} or E = {0, 1, red, green , ...} or E = {0, a, b, c, d, ...}, where 
0 stands for ’’white” and 1 for ’’black.” Colors are used for pixel-oriented 
applications and in case the areas are big enough, any alphabet of symbols 
can be used, which the receiver of the image can read through a transparent 
area. 

A compromise between pixel- and symbol-orientation is the segment-based 
method described in [2], which works as demonstrated in Figure 12.5. It is 
applicable whenever the message consists of symbols that can be represented 
by a segment code, for example the 10 digits by the well-known 7-segment 
code. The encryption method is basically the same: Instead of pixels, longish 
and larger segments are encoded via two possible parallel positions. 

Outline: Based on the above idea in [13], we describe techniques in Section 

12.2 where the user can confirm a transaction as shown in Figure 12.1. Section 

12.3 describes similar techniques that allow the user who received a slide 
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from an account provider to securely enter a PIN or confirm transactions. 
The multiple use of a slide would be an economical and ecological asset and 
improve the convenience of the user who could, for example, leave the slide 
adjusted to the screen, but leads to security problems addressed in [13] and in 
Section 12.4. A further generalization concerning the slide leads to refractional 
(optical) cryptography, which is described in Section 12.5. Technical problems 
are discussed in Section 12.6. Section 12.7 describes Chaum’s application of 
visual cryptography in elections. It verifies that a ballot was counted without 
giving the voter the possibility to show others what she voted for. 


12.2 Trojan-Secure Confirmation of Transactions 

Naor and Pinkas state the application to online transactions implicitly in 
their conference paper [13] . Explicitly it is stated in Appendix A of their full 
paper, which can be found on their homepages. Klein, in 2005, describes this 
Naor/Pinkas ’’transparency onto screen” idea as a main application of visual 
cryptography in [11]. Hogl independently re-invents visual cryptography and 
the Naor/Pinkas idea in the patent application [9]. Greveler refines some of 
the aspects of the Naor/Pinkas idea in [8]. Borchert and Reinhardt [3] discuss 
variants of the Naor/Pinkas idea. 

We assume the computer can be infected with a trojan, which is able to 
eavesdrop and manipulate all input- and output information. Even after a 
secure login, a trojan (Malice) can manipulate a transaction, which is con- 
firmed with the TAN or iTAN method in the following way as in Figure 12.2: 
Bob wants to instruct his banker Alice to transfer 50 dollars to X, but Malice 
chances this to ’’transfer 5000 dollars to Y.” When Alice requests a confirma- 
tion by sending the message ”To transfer 5000 dollars to Y enter the TAN 
No. 37,” Malice changes it to ”To transfer 50 dollars to X enter the TAN No. 
37,” and Bob will cluelessly enter the TAN No. 37. 

To prevent this kind of attack, the authors proposed in [3] methods as in 
Figure 12.1 and Figure 12.4, with the idea that Eve is not able to produce a 
forged encrypted image of the original transaction. Here again, the image of 
message is shifted by a random offset in the x and y-direction to prevent Eve 
from concluding back to the slide. 

However, the method in Figure 12.1 has the disadvantage that the user still 
needs TANs and that Eve might place the image of the original transaction in 
an unencrypted way on the screen, which will have the same appearance with 
the slide as if it would be the encrypted image of the original transaction. 
Thus, Bob might get fooled, if he did not check that there should be a ’’gray” 
pattern without any information before he places the slide. 

This can be improved using the method in Figure 12.4; it makes sure 
that the user is able to see the black balls, which is only possible if (at least 
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FIGURE 12.4 

For confirmation, the user has to click the black balls placed between parts of 
the transaction data. 


most of) the encrypted image from Alice was sent unchanged to Bob. Since 
Malice does not know the position of the parts of the transactions on the 
picture, any attempt to alter a part of the transaction would most likely lead 
to an incorrect image, which can easily be detected by Bob. A similar version 
using the segment-based method in [2] is shown in Figure 12.6 and another 
similar version for mobile phones is shown in Figure 12.3. Two versions using 
Cardano Cryptography, where the user has to verify the transaction consiting 
of an account number by following the blue path, are shown in Figure 12.7 and 
implemented in [1], In the 1-factor confirmation case, the user has to confirm 
entering the numbers along the red path; in the 2-factor confirmation case, 
the user has to confirm by typing his PIN on the keyboard below according 
to the permutation of the digits shown within the red-edged holes. 


12.3 Trojan-Secure Authentication Using a PIN 

The purpose of this section is to apply visual cryptography in a way such that 
the user can enter a password to the server in a way such that the trojan is 
not able to get the password. 
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FIGURE 12.5 

Pixel-based (left) versus segment-based (right) visual cryptography. 
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FIGURE 12.6 

The main method using segment-based visual cryptography in (a) and (b). 
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FIGURE 12.7 

Cardano cryptography: above a 1-factor confirmation (user types 3752), below 
a 2-factor confirmation (for example, in case his PIN is 1234, the user types 
in 4136). 
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FIGURE 12.8 

(a) To log in, the server sends an encrypted image of a permutated keyboard, 
which the user can only read after placing the slide over it. (b) The user enters 
the PIN by clicking at the positions according to their order in the PIN. 


© 2012 by Taylor & Francis Group, LLC 



Applications of Visual Cryptography 


339 


As shown in Figure 12.8, the trojan on the computer is not able to see the 
permutation chosen by Alice on the keys, which was randomly chosen by the 
server. Thus, the mouse-clicks of the user cannot be interpreted by the trojan. 
This method can be generalized to any alphabet and allows Bob to send short 
messages to Alice in a secure way. 

Note here that this method becomes insecure if the message contains mul- 
tiple occurrences of the same symbol, a PIN should thus be chosen without 
repetitions. In case Bob wants to send messages of length l that may con- 
tain repetitions, this could still be accomplished in a secure way by extending 
the alphabet to E U {rr,r 2 , ...,r;_i}, where r t indicates the repetition of the 
symbol at position i. In this way, for example, the message ” messages ” could 
be submitted as ” mesr^agr^rf' containing no repetitions in the extended 
alphabet. 

In order to achieve 2-factor security for transactions, we combine the PIN 
method with the confirmation method of Section 12.2 as described in Figure 
12.9. 

Furthermore, to prevent the attack using the original transaction in an 
unencrypted way on the screen as in Section 12.2, we use the refined method 
of Figure 12.9. 


12.4 Security versus Multiple Use 

To achieve information theoretic security for a single use, we can divide the 
array into clusters of c pixels (resp. areas), where c is the size of the alphabet 
of the encrypted image. Only one pixel in each cluster has a 0 on the slide. 
To encrypt a pixel p £ E, place p at the position of the cluster with the 0 on 
the slide and fill the rest of the cluster with a random permutation of E \ {p}. 
Since each pixel- value in E occurs in each cluster of the encrypted image, each 
image is possible from the viewpoint of an a evesdropper. 

In the model of a known plaintext attack, we assume that the a evesdropper 
Eve may receive the secret image later, then she can find out which position in 
each cluster has the o on the slide and thus the slide cannot be used securely 
a second time. 

Known plaintext is relevant for authentication as considered in [13] as 
well as for confirmation as considered in Section 12.2; in both cases Bob has 
to be convinced that the message was sent by Alice. The problem of multiple 
usability is solved in [13] by dividing the slide in distinct areas, where each has 
to be big enough to contain the complete message; here we use an approach 
with a different distribution. To achieve information theoretic security use a 
slide n times, we propose the following two possibilities: 

1. For one pixel use a cluster of nc pixels divided into n subclusters of c pixels 
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XY-Bank (online debit request) 

Dear Customer, we have received the 
debit request shown below to your 
account #1234567. Please confirm 
by entering your PIN: (via mouse) 
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XY-Bank (online debit request) 

Dear Customer, we have received the 
debit request shown below to your 
account #1234567. Please confirm 
by entering your PIN: (via mouse) 
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FIGURE 12.9 

For confirmation, the user has to click his PIN using a permutation of digits 
on the right side in (a) and (b). 
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FIGURE 12.10 

For confirmation, the user has to click his PIN using inverted numbers. 


in which each subcluster has a 0 on the slide. To encrypt the i - th image, we 
use only the i - th subcluster as above and fill the rest with 1. This leads to 
a contrast of — . 

nc 

2. For one pixel use a cluster of c n pixels, which we address as an n-dimensional 
array (but arrange 2-dimensionally) . Only one pixel in each cluster has a 0 
on the slide. To encrypt a pixel p € E in the i-tli image, place p at each 
position of the cluster, which has the same i-th coordinate as the 0 on the 
slide then choose a random permutation of E \ {p] and fill the rest of the 
cluster in a way such that pixels with the same i-th coordinate get the same 
color. This leads to a contrast of L . 

C n 

In both cases each combination of images is consistent with any combina- 
tion of encrypted images. In the first case, the contrast can be improved only 
to — using refraction, whereas it can be improved to 1 using refraction in the 
second case. 

In the case of an unknown plaintext attack, Eve is still able to obtain the 
secret images if the slide was used too often and if she can anticipate patterns 
in the picture. Let us consider the simple case E = {0,1}, c = 2 and the slide 
was used twice. Then Eve can XOR both encrypted images resulting in an 
image that is 0 at pixels where both original images coincide and 1 at pixels 
where both original images differ, thus she can see the difference of the original 
pictures as shown in [12] page 35 and Figure 12.11. Now assume the original 
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Hallo! 



FIGURE 12.11 

Superimposing two encrypted images for the same key-slide shows the differ- 
ence of the original picture. 


images depict messages using a Font F consisting of / = |F| small symbols 
(symbol-pictures) having q pixels. 

Assume furthermore the symbols are placed on fixed positions, then Eve 
can identify the pairs of symbols on corresponding positions as long as 
f 2 / 2 << 2 q . Then Eve can use, for example, the redundancy of natural lan- 
guages to decipher the text. One measure to complicate this attack is to shift 
the picture by a random number of pixels to the left or the right. Then Eve 
will have to try out the position of the first symbol and consider x ■ y ■ f 2 /2 
combinations, where x and y are the differences of the shifts but smaller than 
the width and the height of the symbols. Further complications can be caused 
by filling the space around the text by partially random patterns, which Bob 
can easily distinguish from the symbols, but Eve will have to start analyzing 
parts in the middle of the image. Here she can only assume that about a quar- 
ter of the surface of the letters overlap, which means this method of attacking 
can be expected to be successfull if x ■ y ■ f 2 /2 « 2 9 / 4 . 

Furthermore, the partially random patterns can compensate the statistical 
imbalance of the correlation of neighboring points. For example, Eve could 
look at pairs of pixels, where one is in some small distance above the other. 
If both are on a position having a 0 on the slide, then, given many encrypted 
images of texts, Eve could detect that they have the same color with a higher 
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probability than other pairs. But the partially random patterns are made in 
a way such that this probability decreases in the overall image. 

Let us now turn to the slides on the previous page: If the slide was used 
more than n times, then Eve can try the following attack: She chooses an area 
of q = x ■ y pixels somewhere in the image, then she tries each combination of 
positions of the 0 in each of the corresponding q clusters on the slide ((2 n ) 9 
possibilities) and checks if it is consistent with each encrypted image in the 
sense that there are 4 symbols in F overlapping the area. This takes 4 -x-y ■ f 
steps. And thus 2 n q ■ 4 • x ■ y ■ f steps in total. 

The number of possible subimages of a possible original image, where four 
symbols overlap, is approximately (x ■ y ■ /) 4 . This means each observed en- 
crypted image can help Eve to exclude a sufficient number of possible choices 
if 2 9 >> (x ■ y ■ /) 4 . We therefore estimate the number of steps for Eve as 
>> {x-y- /) 4 ' ra -A-x-y-f = A-{x-y- /) 4-n+1 . Now assume we use x = y = 10 
and a huge font F with many possibilities to depict a symbol that leads to 
/ = 1000 and roughly 10 20 '" steps for Eve. Considering many obvious and 
also less obvious improvements of the algorithm for Eve, we believe that the 
attack is still too expensive for Eve for n = 3. 


12.5 Using Refraction 


In [4] we generalize the slide from a 2-dimensional array over E = {0,1} to a 
2-dimensional array over E C {l}UMxi with the idea that each pixel on the 
slide can either be black or contains a prism (x, y) that refracts the light from 
a region on the encrypted image or, from the perspective of the user as shown 
in Figure 12.12, refracts the view to a region that is shifted by (x, y) from the 
pixel, which is directly behind the pixel on the slide. For example (0, 0) would 
correspond to the 0 in the case of usual Visual Cryptography just showing 
the pixel directly behind. One possible application would be to use clusters of 
2-2 = 4 pixels for each pixel of the original and randomly choose one of the 4 


pixels to be visible. For example 


( 1 . 0 ) 

( 0 , 0 ) 

( 1 ,- 1 ) 

( 0 ,- 1 ) 


would direct the view to the 


upper right pixel on the encrypted image. This corresponds to construction 2 
in Section 12.4. Using the slide two times is information theoretically secure 
and the contrast is 1. 

If we use lenses or fragments of lenses instead of prisms, the view can be 
focused on a point inside a pixel. This has the advantage that the positioning 
of the slide allows an error of up to half of a pixel. An example is shown in 
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FIGURE 12.12 

This example shows how the view from the observer (A) through prisms (B) 
is directed to areas 1,2,... or 5 on the encrypted image (C); the deviation 
depends on the slope of the prism. 
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FIGURE 12.13 

Some parts of the encrypted image (C) is magnified for the observer (A), 
while other parts are hidden. For example, d and j are in the focus while 
b, c, e, /, h, i, k, and l are hidden. 
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FIGURE 12.14 

Lenses are placed randomly on the slide (b). This can be done by spraying 
a transparent liquid that becomes hard on the side. The area in the focus of 
the lenses in the encrypted image (a) is colored in the color of the original 
image at this region. The rest of (a) is filled such that colors in (a) are equally 
distributed so that the original image can not be obtained from (a) alone but 
only together with the slide (b). 
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FIGURE 12.15 

Each area of the slide (b) has fragments of lenses, which direct the view (c) 
in a magnifying manor to one of the symbols on the encrypted text (a). 


Figure 12.13. While producing fragments of lenses and prisms on the slide 
might require expensive special machines, it will be much cheaper to produce 
complete lenses. Since the lenses do not need to have a perfect shape, it would 
be sufficient to place drops of a transparent liquid that becomes hard on the 
side. This can be done by either using a modified ink-printer or by spraying 
the liquid using physical randomness (and Alice can scan it before sending 
it to Bob). The use of such a slide is shown in Figure 12.14. Figure 12.15 
shows an optical generalization of Cardano cryptography. The advantage to 
Cardano cryptography is that the letters are magnified and can be read in a 
more natural ordering. The advantage to pixel-based visual cryptography is 
that much less precision is needed to position the slide. The disadvantage is 
that, in order to achieve a sufficient level of security, more than four choices 
(like in Figure 12.15) would be required. A repeated use would be too insecure 
as the slide contains only little information. Furthermore, a bigger distance of 
slide and screen is required. 


12.6 Technical Problems Concerning Adjustment 
and Parallaxes 

A disadvantage of pixel-based visual cryptography to Cardano cryptography 
is that the slide has to be placed at an exact position. We propose to position 
the slide at the (for example, left lower) corner of the screen making use of its 
frame. Then use the mouse to position and stretch the encrypted image on the 
screen accordingsly. The parallaxes is the shift of the pixel on the screen that 
can be seen through one point of the slide, which is caused by looking at it from 
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FIGURE 12.16 

The voter enters the vote, verifies the image, and separates the slides. 


a certain angle that differs from the right angle because of central projection 
and because the viewer has two eyes at different positions. This is estimated 
in [10] to be 0.25 mm in the case of a usual TFT screen, less for displays 
of new mobile phones, but might be more if we require a higher distance of 
slide and screen so that the use of refraction can take effect (depending on the 
size of the lenses). Slight misplacements of the slide cause effects like a bad 
contrast or even inverting the picture as described in [10] where the author 
also proposes methods to use interference effects at the frame of the slide as 
an aid for adjustment. 


12.7 Voting with a Receipt Based on Visual 
Cryptography 

The purpose is to give a voter a receipt, which allows her or anyone else to 
verify that her vote was counted in the final result. The difficulty comes from 
the requirement that the voter should not be able to prove to anyone else, 
what her vote was since this would make abuses such as vote selling possible. 

The main procedural method in [6] lets the voter enter her ballot on a touch 
screen and then the voting machine produces two slides laminated together 
that show the ballot image with visual cryptography to the voter only as 
shown in Figure 12.16. Then the voter separates the two slides and goes to 
the poll worker. Here one of the slides is destroyed and the other one is scanned 
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President : 
Asterix □ 
Obelix □ 
Idefix Sf 


President : 
Asterix □ 
Obelix JSf 
Idefix □ 


President : 
Asterix □ 
Obelix □ 
Idefix Bf 


FIGURE 12.17 

Each trustee strips one layer of the doll (represented by the barcode) and uses 
it to modify the image. The order is randomly permutated. 


and uploaded to the official election website. Furthermore, the voter keeps her 
slide as her receipt. 

For confidentiality, the voter has to trust that the voting machine has no 
memory. But how can the results be computed only from the scanned slides? 
To make this possible, the slide cannot be completely random (as usual in 
visual cryptography) but is produced by a pseudorandom generator from the 
cryptographic version of a nested doll that contains the necessary information 
to reproduce the ballot image inside. This means that confidentiality is not 
information theoretically secure but only computationally secure under the 
usual cryptographic assumptions. 

The cryptographic version of a nested doll is produced by the voting ma- 
chine from the serial number of the ballot by successively encrypting with the 
public keys of a sequence of trustees and printed on the slide as a barcode. 
Only all trustees together would be able to compute the ballot image using 
their secret keys. The result of the election is computed by a sequence of mix- 
operations as described in [5] : The first trustee gets a batch of scanned slides 
as input. For each vote, he removes the first layer of the doll and modifies 
the encrypted image using the removed layer of the doll. Then he uploads a 
batch containing a random permutation of the results to the official election 
website. All other trustees do the same with the batch from their predecessor 
(see Figure 12.17). In the batch produced by the last trustee, the dolls were 
used up and the image became the original ballot image, which can be seen 
(and thus counted) by anyone. 

To verify that the trustees worked properly, a public random choice is 
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used to audit the trustees, which have to reveal half of the connections to the 
following batch by publishing the removed layer of the doll, which again allows 
anyone to verify these connections. But the choice was made in a way such 
that there will be no complete path visible leading from a scanned slide to 
its ballot image. In [7], a refinement of the choice is described, which ensures 
that nothing can be learned about the ballots of even groups of voters. 

But how can the voter be sure that she was not cheated by the voting 
machine printing a false second (and later destroyed) slide letting her see her 
ballot image but producing a different one after passing all the mixes? The 
idea is that after the voting machine printed the visual cryptography part on 
the laminated slides, the voter has still the choice to take the upper or lower 
slide as receipt and tell the choice to the voting machine before it continues 
by printing the barcode of the doll to it; in this way the voting machine would 
for each voter only have a 50% chance of cheating without being caught. 


12.8 Conclusion 

Visual cryptography is a fascinating technique and very intuitive to the user. 
However, it is surprising that within the last 15 years since its invention by 
Naor and Shamir only a few suggestions have been made to apply it to prac- 
tical problems. In this paper we presented Naor and Pinkas technique to use 
visual cryptography in order to protect online transactions against manipula- 
tion and Chaum’s idea to apply it to verify the correctness of the outcome of 
an election. Because of difficulties like adjustment, multiple use, and costs of 
special equipment, these suggestions did not lead to applications that are used 
for serious purposes. But in the future, further developments of the ideas pre- 
sented in this paper, as well as new ideas, could spread practical applications 
of visual cryptography. 
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13.1 Introduction 

While gray-scale images can be readily displayed in computer monitors and 
other light-emitting displays, they also need to be displayed routinely in other 
reflective media such as newspaper, magazines, books, and other printed doc- 
uments. However, in reflective media, the application of ink on the reflective 
media implies that only 1-bit images (with two tones: black and white) can 
be displayed. A problem arising from this is that straightforward 1-bit quan- 
tization on an image would lose most of the important image details. With 
such constraints, there is a class of image processing technique called image 
halftoning that converts an 8-bit image into an 1-bit image, which resembles 
the 8-bit image when viewed from a distance. Such 1-bit images are called 
halftone images [1]. Halftone image technologies are widely used in printed 
matters. 

There are two main kinds of halftoning methods: ordered dithering [1] and 
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error diffusion [2]. Ordered dithering uses straightforward 1-bit quantization 
with fixed pseudo-random threshold patterns to give halftone images with rea- 
sonable visual quality. Error diffusion also performs simply 1-bit quantization 
but allows the 1-bit quantization error to be fed back to the system and thus 
can achieve higher visual quality than ordered dithering. 

Sometimes it is desirable to hide watermarking data in halftone images. 
Some halftone image watermarks are designed to be fragile and are useful for 
authentication and tamper detecting of the halftone images. Some halftone 
image watermarks are designed to be robust and are useful for copyright 
protection. In some applications, the data are to be embedded into a single 
halftone image and some special method can be used to read the hidden 
data. In other applications, visual patterns are hidden in two or more halftone 
images such that, when they are overlaid, the hidden visual patterns can be 
revealed. This kindly visual pattern hiding is also called visual cryptography. 
This chapter is about visual cryptography in error diffused halftone images. 

The chapter is organized as follows. Section 13.2 introduces the basic error 
diffusion technique. Section 13.3 introduces a visual cryptography method 
for error diffused images called Data Hiding by Stochastic Error Diffusion 
(DHSED) [3]. Section 13.4 introduces an improved method called Data Hiding 
by Conjugate Error Diffusion (DHCED) [4]. Section 13.5 gives theoretical and 
empirical analysis of DHSED and DHCED. At last, Section 13.6 will give a 
summary of this chapter. 


13.2 A Review of Error Diffusion 


In this section, we will briefly introduce a halftoning method called Error 
Diffusion. The method that we will describe is by no means the only way to 
achieve halftoning, but is a popular approach that gives good visual quality 
while maintaining reasonable complexity. The error diffusion process converts 
a multitone image to a halftone one by distributing the error introduced at the 
current pixel to a neighborhood of yet unprocessed pixels. The neighborhood, 
as well as the weights in the distribution, is described by a set of positions 
and weights known as an error kernel. This diffusion of error across a region 
allows the local intensity of the halftone image to be preserved approximately. 

Consider a multitone image with pixels defined over the range of 0 (black) 
to 255 (white). Let h(k,l) be an error kernel defined over a neighborhood A f. 
For example, the common Steinberg kernel [2] is 


1 

16 


3 


* 

5 


7 

1 


defined over the neighborhood J\f = {(0, 1), (1, —1), (1, 0), (1, 1)}. Here we have 
used * to indicate the location of the current pixel. Let (*, j) be the current 
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pixel location. Let x(i,j) be the current multitone pixel to be processed. A 
modified pixel value u(i,j) will be derived from :r(i, j) and 1-bit quantization 
is applied to u(i,j) to give the output halftoned pixel value y(i,j). Let e(i,j) 
be the error between u(i,j) and y(i,j). In error diffusion, the error e(i,j) is 
distributed to future pixels in its neighborhood. For the case of error diffusion 
using the Steinberg kernel, a portion yg of e(i,j) will be distributed to (i,j+ 1) 
corresponding to (0, 1) in A/”. Similarly, yg of e(i,j) goes to (i + l,j — 1), A 
of it goes to ( i -I- 1 , j), and yg of it goes to (i + 1, j + 1). 

For location an offset term a(i,j) is defined as 

a(i,j) = e(i — k,j — l)x h(k,l) (13.1) 

MeJV 


which is the total error propagated from past pixels to the current pixel. For 
the error at location (i — k,j — l), a portion h(k,l) of it is passed to the 
current pixel according to the error kernel. The modified pixel value u(i, j) is 
then defined as 

u(i,j) = x(i,j) +a(i,j) (13.2) 

The output halftone value y(i,j) is defined as 


y(i, 



0 , 

255, 


u(i,j) < 128 
u(i,j) > 128 


(13.3) 


and the error e(i,j) is 

e(i,j) = u(i,j) -y(i,j) (13.4) 

These steps are summarized in Figure 13.1, in which the block Q(-) is the 
1-bit quantization and the block is the error kernel applied to past errors 
in the neighborhood to generate the current offset a(i. j). 

Consider the special case of X being of constant intensity A in a neighbor- 
hood around (?', j). As error diffusion can preserve the average image intensity, 
the probability distribution of a halftone pixel y(i,j ) is 



FIGURE 13.1 
Error diffusion process. 
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P[y(i,j) = 255]= A/255 (13.5) 

P[y(i,j) = o] = (255 - A)/255 (13.6) 

such that 

£[y(M)] = 0 • P[y(i,j) = 0] + 255 . P[y(i,j) = 255] 

= 0 • (255 - A) /255 + 255 • A/255 
= A (13.7) 

Typically, the percentages of white and black pixels in X are A/255 • 100% 
and (255 — A) /255 • 100% respectively, distributed evenly in X. In a way, one 
can argue that 

P[y(i,j) = 255| x(i,j)] = x(i, j)/255 (13.8) 

such that 

E[y(i,j)\x(i,j)} = x(i,j) (13.9) 

Another common error diffusion kernel is the Jarvis kernel [5] 

*7 5' 

3 5 7 5 3 
1 3 5 3 1 


1 

48 



FIGURE 13.2 

Original multitone ’’Lena” (X). 
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FIGURE 13.3 

Halftone image generated by error diffusion with the Steinberg kernel. 



FIGURE 13.4 

Halftone image generated by error diffusion with the Jarvis kernel (Yi). 
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which has a larger support than the Steinberg kernel. A typical image, Lena, 
is shown in Figure 13.2. The corresponding halftone images generated by 
Steinberg and Jarvis kernels are shown in Figures 13.3 and 13.4 respectively. 
It can be observed that different error diffusion kernels give rise to different 
textures in the halftone images. In general, Jarvis gives images with higher 
contrast while the Steinberg kernal gives smoother texture. Both are capable 
of generating halftone images that mimic the original images when viewed 
afar, though tiny details of the original image such as Lena’s hair tend to be 
masked by the halftone image texture generated by the error kernel. 

The size of all the images in this chapter are 512x512. Due to limited space, 
all remaining halftone figures are generated by the Jarvis kernel only, though 
the methods described in the chapter are applicable to any error diffusion 
kernels. 


13.3 Data Hiding by Stochastic Error Diffusion (DHSED) 

Data Hiding for halftone images is quite different from that for multitone 
images due to the fact that halftone pixels can take on only two values: 0 and 
255. They contain high frequency noise but resemble the original multitone 
images when viewed afar. As such, normal data hiding techniques such as 
least significant bit (LSB) embedding technique [6] would not work on them 
because the resulting stego-images will be effectively the watermark image 
and would not resemble the original multitone images even when viewed afar. 
Thus, it is necessary to develop special data hiding techniques for halftone 
images. Although several data hiding technologies for halftone images have 
been proposed before, Data Hiding by Stochastic Error Diffusion (DHSED) is 
the first visual cryptography method based on error diffusion. 

DHSED is a method that embeds a binary secret pattern into two halftone 
images derived from the same underlying multitone image. The binary pattern 
should be revealed when the two halftone images are superimposed. The idea 
of DHSED is to stochastically create a texture phase shift between the two 
halftone images at locations where the watermark is ” active” or black (binary 
pattern value being zero). The resulting mismatch allows the watermark to 
become visible while maintaining the original halftone background. Let X be 
the original multitone image and W the binary secret pattern of the same 
size. Let Y\ be a halftone image obtained by applying regular error diffusion 
to X. Let Y 2 be the halftone image obtained through DHSED. The problem, 
then, is to obtain Y 2 such that W is revealed when Y\ and Y 2 are overlaid. 
We denote the individual pixels at location (i,j) of both halftone images as 
yi(i,j) and y 2 (i,j), respectively. 

The second image Y 2 is generated by applying regular error diffusion to 
certain areas in X, but with different error conditions. These areas are ob- 
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tained by referencing both Yi and W. Let Wb be the collection of the locations 
of all the black pixels in W , and W w the collection of the white pixel locations. 
In constructing Y 2 , we will force the pixel value at all locations belonging to 
W w to be identical to Yi. In other words, values at these locations are merely 
copied from Yi to Y' 2 . That is, 

V2 (i,j) = V(i, j) G W w (13.10) 

For the remaining pixels in Wb, Y 2 needs to look natural and thus DHSED 
applies error diffusion with the same error kernel. However, DHSED seeks to 
make Y 2 different from Yi statistically so that when they are overlaid, pixels 
in Wb would tend to be darker. To achieve this, DHSED first morphologically 
dilate, Wb with a structuring element D consisting of a (2 L + 1) x (2 L + 1) 
matrix. We denote the dilated Wb as C. 

C = W b ®D (13.11) 

which can be interpreted as a L-pixel expansion of Wb in all directions. 

For the pixels outside C, DHSED copies Y 2 from Yi using (13.10) but 
forces the error for Y 2 to be zero, i.e. e 2 (i, j) = 0 for (i,j) fL C. Note that the 
error for Yi are nonzero in general for the same locations. 

Let E = C— Wb = C fl W U! be the ’’border” of the secret pattern, obtained 
by removing Wb from the expanded region C. For the pixels in E, (13.1) and 
(13.2) are still applied while (13.3) and (13.4) are not. (13.10) will be used to 
replace (13.3) since E C W w and Y 2 pixels in W w are copied from Yi. We will 
use (13.12) to replace (13.4). 

e 2 (i,j) = max{min{u 2 (i, j) - y 2 (i, j), 127}, -127} (13.12) 

which is basically (13.4) with a limiter. As Y 2 pixels in E are copied from Yi 
with artificial zero error outside C, there are chances that u 2 ('t, j) — t/ 2 (i,j) is 
outside ±127. The limiter would then help to make the e 2 («, j) reasonable. 

For the pixels in Wb, DHSED uses regular error diffusion to generate Y 2 
so that region Wb in Y 2 still has the same characteristic texture as regular 
error diffusion. But the ’’phase” of the texture will be different compared to 
the corresponding region in Yi since the error outside the region C is different 
in Yi and Y 2 . 

The overlaying operation is equivalent to applying the logical AND oper- 
ation between images Yi and Y 2 . Since the pixels in region W w of Yi and Y 2 
have been forced to be identical, the overlaid pixel values are simply the reg- 
ular error diffused pixel values. However, in region Wb, although the texture 
in Yi and Y 2 maintains the same characteristic, there is an artificially intro- 
duced phase shift such that collocated Yi and Y 2 pixels tend to be statistically 
independent. As a result, the overlaying operation tends to give darker local 
intensity thus revealing the secret pattern W. A more detailed analysis of this 
will be given in Section 13.4. 

Using Lena as the test image and Figure 13.5 as the secret binary pattern 
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USTUST 

USTUST 

USTUST 


FIGURE 13.5 

Secret pattern ”UST” to be embedded in the halftone image ( W ). 



FIGURE 13.6 

DHSED-generatecl Y 2 ( L = 5) of Lena with respect to X in Figure 13.2, W 
in Figure 13.5, and Y\ in Figure 13.4. 
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FIGURE 13.7 

Image Y obtained by overlaying Y[ in Figure 13.4 and Y 2 in Figure 13.6. 


W, Figure 13.4 is Yi and Figure 13.6 is Y 2 generated using DHSED with 
respect to Y\ and W. A threshold L = 5 is used. Note that Figure 13.6 
looks like Figure 13.4, which verifies that DHSED can give halftone images 
with good visual quality. Figure 13.7 shows the image obtained by overlaying 
Figure 13.6 and Figure 13.4. The secret pattern W is clearly visible in Figure 
13.7 verifying that DHSED is an effective visual cryptography method. 


13.4 Data Hiding by Conjugate Error Diffusion (DHCED) 

DHSED as outlined in the previous section is both computationally and con- 
ceptually simple, but suffers from three major problems. First, Y\ and Y 2 
must be obtained from the same X. In other words, DHSED cannot embed 
a binary secret pattern in two halftone images obtained from two different 
multitone images. Second, when the images are overlaid, the contrast of the 
revealed secret pattern is relatively low. Third, occasional boundary artifacts 
may happen in Y 2 especially towards the right and bottom sides of the secret 
pattern where error is not diffused properly across the Wf, boundary. Such 
boundary artifacts can lower the visual quality of Y 2 considerably. 

In this section, we will introduce another method called Data Hiding by 
Conjugate Error Diffusion (DHCED) that addresses these three problems. 
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MW yifW 


xidj) 



FIGURE 13.8 

The DHCED (Data Hiding by Conjugate Error Diffusion) process. 


The block diagram of DHCED is shown in Figure 13.8. Unlike DHSED, the 
problem now contains two original multitone images X\ and where Xi 
and X% may or may not be identical. Two halftone images Y\ and Yi are to 
be generated from X\ and X 2 , respectively such that when Y\ and I 2 are 
overlaid, the binary secret pattern W is revealed. Similar to DHSED, Yj is 
generated using regular error diffusion on X\. Then the DHCED process in 
Figure 13.8 is used to generate Y%. 

To explain the detailed operation of DHCED, we assign logical ” 1” to pixel 
value 255 and logical ”0” to pixel value 0. The conjugate of a pixel is then 
equivalent to logical NOT, or toggling of the value. Recall that W w and iUf, 
are the collections of white and black pixel locations in W, respectively. As 
Y\ is already generated by regular error diffusion, the secret pattern W at 
location (i,j) can be naively inserted in Y% as follows 





w(i,j) = 1 
w(i,j) = 0 


(13.13) 


where (-) c denotes logical NOT. This is equivalent to logical XNOR between 
Yi and W. The resulting Yq will look like X\ in W w and the negative of X\ 
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E [yi(i,j)\w{i,j) = l,x x (i,j)\ 

= E[yi{i,j)\xi{i.,j)} 

= 255 • P[yi(i, j) = 255|aji(i,j)] + 0 • P[yi{i,j) = 0|a:i(i,j)] 

= 255 • P[yi(i,j) = 255|ari(i, j)] 

= 255 • [x\(i, j)/255] 

= xi(i,j) (13.14) 


E[yi{i,j)\w{i,j) =0,xi (i,j)\ 

= E[yi(i,j)\xi(i,j)] 

= 0 • P[yi(i,j) = 255\x 1 {i,j)]+255»P[yi{i,j) =0|a:i(i,j)] 

= 255.[l-P[|/i(*,j) = 255|*(i,j)]] 

= 255 — xi(i,j) (13.15) 

But Y 2 should resemble X 2 instead of X\ and thus this naive method does 
not work. Even if X- t and X 2 are the same image, this naive method does not 
work in Wf, as Y 2 should resemble X\ instead of the negative of X\. 

Although this naive method does not work, DHCED follows a similar logic 
except that it favors, instead of forces, Y 2 to take on the values in (13.13). In 
other words, it treats the value in (13.13) as the favored value of y 2 (i,j). 

Consider Figure 13.8 and any location (i,j) e Wb- Basically, DHCED 
applies error diffusion on x 2 (i,j) including (13.1) to calculate a 2 (i,j), (13.2) 
to calculate u 2 (i,j) and, in the first Q(-) block, (13.3) to calculate the trial 
halftone value 1/2 (*, j)- In the N(-) block, the trial value is compared with the 
favored value that is obtained by XNOR of w(i,j) and yi(i,j)- If they are 
equal, no change needs to be done to x 2 {i,j) and u 2 {i,j) such that u' 2 {i,j ) = 
u 2 (i,j). If they are not equal, DHCED considers the possibility of forcing 
trial j/ 2 (I, j) to toggle to achieve the favored value. Recognizing that forced 
toggling is equivalent to applying a distortion to x 2 (i,j) followed by regular 
error diffusion, DHCED will execute the forced toggling only if the required 
distortion is not excessive. 

Here are the details. Note that forcing the trial halftone value to toggle 
is equivalent to adding an offset value A u(i,j) to u 2 (i,j). If the trial value 
should be toggled from 0 to 255, then u 2 (i,j) < 128 initially and we need 
an offset A u(i,j) such that the resulting value, which we called u' 2 (i,j), is 
u' 2 (i,j) = u 2 (i,j) + A u(i,j) > 128. Thus, there is a lower bound for A u(i,j): 
A u(i,j) > 128 — u 2 (i,j) > 0. 

Likewise, if we want to toggle from 255 to 0, then u 2 (i,j) > 128 initially 
and we need an offset A u(i,j) such that u' 2 (i,j ) = u 2 (i,j ) + A u(i,j) < 127. 
There is thus an upper bound for A u(i,j): A u{i,j) < 127 — u 2 (i,j ) < 0. 

The smallest A u(i,j) (in terms of magnitude) needed to achieve toggling 
is 
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Au(i,j) 


128 - u 2 (i,j), u 2 (i,j ) < 128 
127 -u 2 (i,j), u 2 (ij)>l28 


(13.16) 


We further note that adding a distortion A u(i,j) to u 2 (i,j) may be inter- 
preted as a distortion to the original multitone image pixel x 2 (i,j). Defining 
A x(i,j) = Au(i,j), the input to the normal quantizer u 2 (i,j) may be written 
as 


u 2 (i,j) = u 2 (i,j ) + A u(i,j) 

= x 2 (i,j)+ 53 e 2 (i - k,j - l) x h(k,l) + Au(i,j) 
k,l£Af 

= x 2 (i,j)+ 53 e 2 (i - k,j - l) x h(k,l) (13.17) 

k,ieAT 

x 2 (i,j) = x 2 (i,j) + Au(i,j) = x 2 (i,j) + Ax(i,j) (13.18) 

The interpretation of (13.18) is that the output halftone image using 
DHCED in fact represents X 2 , not X 2 , in the sense of that it can be ob- 
tained from X 2 directly using standard error diffusion. Thus, |Ax| can be 
treated as a measure of the distortion introduced by the DHCED process. To 
control this distortion, we define a threshold T that determines whether or not 
the pixel should be toggled, allowing a trade-off between distortion and visual 
quality of the watermarked halftone image. If |Ax| is less than T, the pixel 
toggling will be performed, and vice versa. If T decreases, the visual quality 
of the watermarked image Y 2 will improve at the price of lower contrast of the 
secret pattern when the two halftone images are superimposed. 

Consider any location (i, j) £ W w . If X ± and X 2 are the same image, 
DHCED would copy y\ ( i,j ) to y 2 ( i,j ) so that Y 2 values are effectively obtained 
by applying error diffusion to X\. The error e 2 (i,j) will be computed as in 
normal error diffusion. When Y\ and Y 2 are overlaid, the regular error diffused 
value yi(i,j) will be revealed. The overlaying operation will reveal a local 
intensity similar to the local intensity of X\ , which is typical for regular error 
diffusion. 

If X\ and X 2 are different, DHCED would not force y 2 {i,j) to be identical 
to yi(i,j) at (i,j) G W w . Instead, it merely treats yi{i,j) as the favored value 
of y 2 {i,j). And DHCED performs the same operation as in Wb- 

The proposed DHCED for the case of identical and X 2 is simulated. 
Using Lena as the test image and Figure 13.5 as the secret binary pattern W, 
Figure 13.4 is Y\ and Figure 13.9 is Y 2 generated using DHCED with respect 
to Y\ and W. A threshold of T = 10 is used. Note that Figure 13.9 looks like 
Figure 13.4 which verifies that DHCED can give halftone images with good 
visual quality. Figure 13.10 shows the image obtained by overlaying Figure 
13.9 and Figure 13.4. The secret pattern W is clearly visible in Figure 13.7 
verifying that DHSED is an effective visual cryptography method. 
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FIGURE 13.9 

DHCED-generated Y 2 (T = 10) of Lena with respect to X in Figure 13.2, W 
in Figure 13.5, and Y 1 in Figure 13.4. 


Comparing DHSED and DHCED, it can be observed that DHSED in Fig- 
ure 13.6 has strong boundary artifacts along the embedded watermark es- 
pecially on the right and bottom edges of W. With DHCED, the boundary 
artifacts are reduced considerably. In addition, the watermark in Figure 13.10 
is significantly more visible than Figure 13.7 in terms of contrast, when Y\ 
and Y ‘2 are overlaid. 

DHCED for the case of different Xi and X 2 is also simulated. Here Lena 
is used as X\ and Pepper is used as X 2 . The Y\ with respect to X\ is simply 
the one in Figure 13.4. The DHCED generated Y 2 from X 2 with respect to Y\ 
and W is shown in Figure 13.12. A threshold of T = 10 is used. The overlaid 
image of Y\ and Y 2 is shown in Figure 13.13. As expected, traces of both 
Lena and Pepper can be observed in the overlaid image. More importantly, 
the watermark W is revealed also, though the contrast of W in Figure 13.13 
is not as good as in Figure 13.10. 


13.5 Performance Analysis 

In this section, we give an indepth analysis of both DHSED and DHCED. We 
will show theoretically why DHCED has better performance than DHSED. 
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FIGURE 13.10 

Image Y obtained by overlaying Yi in Figure 13.4 and Y 2 in Figure 13.9. 



FIGURE 13.11 

Original multitone ’’Pepper” (A' 2 ). 
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FIGURE 13.12 

DHCED-generated Y 2 (T = 10) of Pepper with respect to X 2 in Figure 13.11, 
W in Figure 13.5, and Y\ in Figure 13.4. 



FIGURE 13.13 

Image Y obtained by overlaying Y\ in Figure 13.4 and Y 2 in Figure 13.12. 
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Consider the case when X\ and X 2 are the same image X. Consider a rectan- 
gular region R of constant intensity A in X. Suppose that the left half of R is 
in the white region W w of W and the right half in the black region Wb of W. 
We assume that error diffusion is effective in both the left and right halves of 
R such that the average image intensity is preserved. Thus, the probability 
distribution of a halftone pixel yi(i,j) in the region R of Y\ is 

P[yi(i, j) = 255] = ,4/255 (13.19) 

P[yi(i, j) = 0] = (255 - A)/ 255 (13.20) 

such that the expected value is 

E[yi(i,j)\ =0*P[ yi (i,j) =0] + 255 •P[y 1 (i,j) = 255] = A (13.21) 

for (i,j) € R. Typically, the percentage of white and black pixels in Y\ in R 
are ,4/255 • 100% and (255 — A)/ 255 • 100% respectively, distributed evenly 
in R. 

The generation of Y 2 using DHCED is effectively the application of error 
diffusion to the equivalent noisy multitone image. And the error diffusion 
should be effective, as usual. The distortion A x(i,j) introduced by DHCED 
is equally likely to be positive and negative and its magnitude is bounded 
by T. The average intensity in R should still be approximately A. Thus, the 
probability distribution of a halftone pixel y 2 (i,j) in the region R of Y 2 is 
approximately 

P[y 2 (i, j) = 255] « A/255 (13.22) 

P[y 2 (i, j) = 0] « (255 - A)/255 (13.23) 

such that 

E[y 2 (i,j)\ = 0 . P[y 2 (i,j) = 0] + 255 . P[y 2 (i,j) = 255] « A (13.24) 
for (i,j) <E Ra- 

Let y(i,j) = yi{i,j) f]V 2 {i,j) be the output pixel obtained by overlaying 
Y\ and Y 2 . The y(i,j) would be white only if both yi(i,j) and y- 2 (i,j ) are 
white. For the proposed DHCED, the yi(i, j) and y 2 (i,j) are designed to be 
dependent. 

In the left half of R , which is in W w , DHCED would simply copy yi(i,j) 
as y 2 (i, j) such that P[y- 2 (i,j) = y\{i,j)] = 1. Then 

P[y(i,j) = 255] = P[yi(i,j) p|ifc(M) = 255] = P[yi(i,j) = 255] = A/255 

(13.25) 

such that 

E[y(i, j )] = 0 . P[y(i, j ) = 0] + 255 . P[y(i,j) = 255] = A (13.26) 

In other words, y(i,j) = yi{i,j)) = 3 / 2 (b /) f° r the region W w and the overlay 
operation does not change the halftone pixel values at all. 
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In the right half of R which is in W b , the yi(i,j) and y 2 (i,j) are favored to 
be conjugate to each other (y 2 (i,j) ~ yi (i,j)) such that yi(i,j) and y 2 (i,j) 
tend not to be black at the same time. To investigate the behavior of y(i,j), 
we consider two different cases: (1) 255 > A > 127 and (2) 127 > A > 0. 

For the case of 255 > A > 127, there are more white pixels than black 
pixels in R of hj . The percentage of black pixels in the right half of R of Y\ 
is about (255 — A)/ 255 • 100%. For example, if A = 190, about 25% of the 
pixels in the right half of R of Y-\ should be black. As y-\ (i. j) and y 2 (i,j ) 
tend not to be black at the same time, the black pixels in the right half of 
R of Y ‘2 tend to be at different locations from those in Y\ . Consequently, the 
percentage of black pixels in the right half of R of Y tends to be doubled to 
2 • (255 — A) /255 • 100%. In our example of A = 190, the approximately 25% 
black pixels in the right half of R of Y\ and those of Y 2 tend to be at different 
locations such that there are about 50% black pixels in the right half of R of 
Y. Thus, 


P[y(i,j) = 0] « 2 P[ yi (i,j) = 0] = 2(255 - A)/255 (13.27) 

P[y(i, j) = 255] « (2 A - 255) /255 (13.28) 


such that 


E[y(i,j)] = 0 . P[y(i,j) = 0] + 255 . P[y(i,j) = 255] 

« 2A — 255 = A - (255 — A) < A (13.29) 

In other words, the expected value should increase approximately linearly with 
A, from 1 (for A = 128) to 255 (for A = 255). The difference between the 
average intensity of the left and right halves of R for 255 > A > 127 is 

A ' intensity = E[y(i, j)\(i, j) £ W w ] - E[y(i, j)\(i, j) G W b \ 

S3 A - (2A - 255) = 255 - A (13.30) 

For the case of 127 > A > 0, there are fewer white pixels than black pixels 
in the right half of R of Y-\ . Again the and y 2 (i,j ) tend not to be black 

at the same time in DHCED. This implies that the black pixels in the right 
half of R of Y 2 tend to fill up all the white pixel locations in the right half of 
R of Yi, leading to all y{i,j) being black. Thus, P(y(i,j ) = 0) ss 1 and 

E[y(i,j)] = 0 . P[y(i,j) = 0] + 255 . P[y(i, j) = 255] « 0 (13.31) 

for 127 > A > 0. And the difference between the average intensity of the left 
and right halves of R is, for 127 > A > 0, 

A intensity « A — 0 = A (13.32) 

Consequently, the contrast between the left and right halves of R of Y can be 
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expressed as, for 255 > A > 127, 

contrast = G Ww \ ~ E \v^3) I {hi) e W b ] 


E[y{i,j)\{i,j) e W v 
A - (2A - 255) 255 - A 255 


A 


A 


- 1 


(13.33) 


and, for 127 > A > 0, 


contrast = G Ww 1 ~ j)Kb •?) e ^ 

£[y(M')l(b j) e w w ] 

A-0 


A 


= 1 


(13.34) 


To summarize, for any (i, j) in the right half of R that is in W b , the 
expected value of y(i,j ) is 


E [v{hi)] 


0, 127 > A > 0 

2A - 255, 255 > A > 127 


(13.35) 


The difference in average intensity of the left half and right half of R is 


A intensity 


A, 127 > A > 0 

255 - A, 255 > A > 127 


(13.36) 


and the contrast between the left half and right half of R is 


contrast : 


1, 127 > A > 0 

^ - 1, 255 > A > 127 


(13.37) 


To verify these, we simulate DHCED using an artificial image called 
’’Ramp” shown in Figure 13.14 as X = X\ = A' 2 , in which the image in- 
tensity decreases gradually and linearly from 255 at the top row to 0 at the 
bottom row. The hidden pattern to be embedded is called ’’Column” and is 
black at the center and white on the left and right, as shown in Figure 13.15. 
The DHCED generated Y\ and >2 are shown in Figures 13.16 and 13.17, re- 
spectively. The row-wise average intensity of Yi and Y 2 are plotted against 
the average intensity of the corresponding row in X in Figure 13.22. As ex- 
pected, the row- wise average intensity of Y[ and Y 2 are very similar to the 
corresponding intensity in X, which verifies (13.21) and (13.24). 

Figure 13.18 is the overlaid image Y. We note that in the W w region, Y is 
identical to Y) and Y 2 , with intensity decreasing from top to bottom. In the 
Wb region, the intensity of Y is as high as X at the top. But as the intensity 
of X decreases from the top to bottom, we observe that the intensity of Y 
decreases at a fast pace to about the middle of the image (where intensity is 
about 127), and remains low in the lower half of the image. 

To show the exact behavior of Y in the W b region, we compute the average 
intensity in the W b for each row of Y and plot it against the average intensity of 
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FIGURE 13.16 

Halftone images generated by error diffusion with the Jarvis kernel (Yi). 



FIGURE 13.17 

DHCED-generated Y 2 ( T = 10) of Ramp with respect to X in Figure 13.14, 
W in Figure 13.15, and Y\ in Figure 13.16. 
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FIGURE 13.18 

Image Y obtained by overlaying Y\ in Figure 13.16 and Y 2 in Figure 13.17. 


the corresponding row in X in Figure 13.19. Three such curves are obtained 
with 3 values of T, namely T = 5, 10, 15. Also shown in the figure is the 
theoretical behavior as predicted by (13.35). It can be observed from the 
figure that as T increases, the average intensity curves appear to converge to 
the theoretical curve, as expected. 

We also compute the difference between the average intensity in the Wb 
and the W w regions for each row of Y, and plot this A intensity against the 
average intensity of the corresponding row in X in Figure 13.20. Similarly, 
the contrast is computed and plotted in Figure 13.21. Also shown in the two 
figures are the theoretical behavior predicted by (13.36) and (13.37). It can be 
observed that as T increases, the A intensity curves and the contrast curves 
appear to converge to the corresponding theoretical curves, as expected. 

Next, we analyze DHSED and make a comparison with DHCED. Since 
DHSED forces Y\ and Y 2 to be identical in W w , both yi(i,j) and y 2 (i,j ) are 
identical in the left half of R and the probability distribution is 

P[y(i,j) = 255] = P[yi(i,j) n y 2 {i,j) = 255] = P[yi{i,j) = 255] = A/255 

(13.38) 

such that E[y(i. j)\ = A. For any (i,j) in Wb, the corresponding pixel values 
in Y[ and in Y 2 are error diffused with relative random phase. Thus, the local 
intensity for Y\ and Y 2 is 

E[yi{i,j)\ = E[y 1 (i,j)\ = A (13.39) 
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FIGURE 13.19 

Row-wise average intensity of Wf, in Y in Figure 13.18 vs row-wise average 
intensity of X in Figure 13.14 (Ramp). 



FIGURE 13.20 

Row- wise Aintensity of Y in Figure 13.18 vs row- wise average intensity of X 
in Figure 13.14 (Ramp). 
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FIGURE 13.21 

Contrast of Y in Figure 13.18 vs row-wise average intensity of X in Figure 
13.14 (Ramp). 



FIGURE 13.22 

Row-wise average intensity of Y\ in Figure 13.4 and Yi in Figure 13.9 vs 
row-wise average intensity of X in Figure 13.14 (Ramp). 
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and yi(i,j) and are approximately independent with 

P[y(i,j) = 255] = P[y i(i, j) n y 2 (i,j) = 255] 

= P[yi{i,j) = 255] . P[y 2 {i,j) = 255] = (A/255) 2 (13.40) 

P[y{i,j) = 0] = 1 - (A/255) 2 (13.41) 

such that 

E[y(i,j)\=A 2 / 255 (13.42) 

Thus, the intensity of DHSED is expected to be greater than or equal to that 

of DHCED, with equality if A = 255. The difference in average intensity is 

A intensity = E[y(i,j)\(i,j) £ W w ) - E[y(i,j)\(i,j) £ W b \ 

= A - A 2 /255 (13.43) 


The contrast is 


contrast = 


E[y{i,j)\{i,j) £ W w ] - E[y(i,j)\(i,j) £ W b ] 
E[y(i,j)\(i,j ) e W w ] 

A - A 2 /2tt _ 255 - A 
A ~ 255 


(13.44) 


We also simulate DHSED on Ramp to verify the equations above. The 
hidden pattern is still the Column in Figure 13.15. The DHSED generated Y\ 
and Y 2 are shown in Figures 13.16 and 13.23, respectively. In Figure 13.28, 
the row-wise average intensity of Y\ and Y 2 are plotted against the average 
intensity of the corresponding row in X. As expected, they are very similar 
to X, which verifies (13.39). 

Figure 13.24 is the overlaid image Y . Similar to DHCED, the Y of DHSED 
is identical to Y\ and Y 2 in the W w region, with intensity decreasing from top 
to bottom. In the W b region, the intensity of Y is as high as X at the top 
row. But as the intensity of X decreases towards the bottom of the image, 
the intensity of Y decreases faster in the center than on the two sides. In 
other words, the intensity of Y decreases faster in W b than in W w , making 
Wb visible in Y . 

Similar to DHCED, to show the exact behavior of DHSED in W b in Y, we 
compute the average intensity in the W b for each row of Y and plot it against 
the average intensity of the corresponding row in X in Figure 13.25. Three 
curves are obtained for 3 values of L , namely L = 1,5, 10. Also shown is the 
theoretical curve according to (13.42). It can be observed that the 3 empirical 
curves match the theoretical curve very well. This also suggests that the choice 
of L does not have much effect on the intensity of W b in Y. 

We also compute the difference between the average intensity in W b and 
W n , regions for each row of Y, and plot this A intensity against the average 
intensity of the corresponding row in X in Figure 13.26. Similarly, the contrast 
is computed and plotted in Figure 13.27. Also shown in the two figures are 
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FIGURE 13.23 

DHSED-generated Y 2 ( L = 5) of Ramp with respect to X in Figure 13.14, W 
in Figure 13.15 and Y\ in Figure 13.16. 



FIGURE 13.24 

Image Y obtained by overlaying Yi in Figure 13.16 and Y 2 in Figure 13.23. 
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FIGURE 13.25 

Row-wise average intensity of Wf, in Y in Figure 13.24 vs row-wise average 
intensity of X in Figure 13.14 (Ramp). 



FIGURE 13.26 

Row- wise Aintensity of Y in Figure 13.24 vs row- wise average intensity of X 
in Figure 13.14 (Ramp). 
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FIGURE 13.27 

Contrast of Y in Figure 13.24 vs row-wise average intensity of X in Figure 
13.14 (Ramp). 


the theoretical behavior predicted by (13.43) and (13.44). It can be observed 
that the empirical A intensity curves and contrast curves are similar to the 
corresponding theoretical curves, as expected. Again, the choice of L has little 
effect. 

Comparing DHCED and DHSED, they have the same Y\. For their Y 2 , 
their pixel values are identical in W w but different in Wb . On overlaying the 
corresponding Yi and Y 2 , the Y of both DHCED and DHSED are identical in 
W w , but DHCED has lower E[y(i,j)] in Wb than DHSED such that the black 
patterns of W would look darker in DHCED than in DHSED as predicted by 
Figure 13.29. And, the contrast of the revealed W in DHCED is higher than 
that in DHSED as predicted by Figure 13.30. 


13.6 Summary 

In this chapter, we introduce two ways to achieve steganography in halftone 
images, namely DHSED and DHCED. Both methods can embed a binary 
secret pattern into two halftone images that come from the same multitone 
image. When the two halftone images are overlaid, the secret pattern is re- 
vealed. DHCED can further embed a binary secret pattern into two halftone 
images from two different multitone images. DHSED operates by introducing 
different stochastic phases in the two images. DHCED operates by favoring 
certain conjugate values for each pixel and taking on the values only if the 
implied distortion is small enough. Both theoretical analysis and simulation 
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FIGURE 13.28 

Row-wise average intensity Yi in Figure 13.4 and Y 2 in Figure 13.23 vs row- 
wise average intensity of X in Figure 13.14 (Ramp). 



FIGURE 13.29 

Theoretical average local intensity of Wj, in Y for DHSED and DHCED vs 
row- wise average intensity of X in Figure 13.14 (Ramp). 
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FIGURE 13.30 

Theoretical contrast of Y for DHSED and DHCED vs row-wise average in- 
tensity of X in Figure 13.14 (Ramp). 


results suggest that DHCED can give better contrast of the revealed secret 
pattern than DHSED. 
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14.1 Introduction 

Cryptography plays a very vital enabling role in our modern computing infra- 
structure. Almost all real-world applications require keys (such as passwords) 
for the purposes of confidentiality, authentication, and nonrepudiation. The 
strength of such cryptographic applications is based on the secrecy of a key. 
Therefore, the loss of a key can lead to disastrous consequences. Thus, many 
cryptographers have tackled the following problem: 

Suppose a secret s (a key) is divided into n > 1 parts (called secret shares) 
and it satisfies these properties: 

1. The secret key s can be easily restored from k (k < n) shares. 

381 
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2. The secret key s cannot be restored from k — 1 (or less) shares. 

3. The size of each share is not more than the size of the secret key s. 

Such a scheme is referred to as a (fc, n) threshold cryptography scheme 
or a secret sharing system [2] [17]. It provides a backup mechanism to the se- 
cret key and it provides protection against the loss of a key. Secret sharing is 
also regarded as a mechanism to transfer secret information by public chan- 
nels in cryptography [4]. Blakley based his secret sharing scheme on hyper- 
planes [17] and Shamir provided a solution based on the Lagrange interpo- 
lation [2]. Asmuth and Bloom scheme is based on the Chinese Remainder 
Theorem [5]. The details of these methods are available in [1] [12]. These tra- 
ditional secret sharing schemes primarily concentrate on bit strings and do 
not take the specific content of these bits into account. However, with the 
increasing emphasis on security and digital rights management of multime- 
dia data, the connection between multimedia and cryptography is becoming 
stronger. In this context, we present our novel ideas on color image sharing in 
which we utilize the concept of secret sharing from cryptography and employ 
it to protect a secret color image. As we shall see, the ideas cannot be directly 
applied so we need to take into account that the data under consideration 
describes color images and is not any generic bit stream. In our scheme, a 
secret color image is divided into n shares. Each share is an innocuous image 
totally unrelated to the secret image. We utilize k (or more) shares in order 
to perfectly reconstruct the secret image. However, having access to k — 1 (or 
less) shares will not reveal the secret color image. 

We envisage several useful applications for a color image sharing scheme. 
Suppose we have a secret color image that we desire to protect. If we employ 
traditional cryptographic techniques, then we need to encrypt the image and 
store the image on a secure server. We then need to pay attention on the 
security of the key used for encryption. This server would then become a single 
focus of attack from a potential adversary. However, with an image sharing 
scheme, we can divide the information in the image into several shares and 
keep them on separate servers. This would allow for a lot more redundancy 
in the protection since breaking one server will not reveal the secret image. 
Another application would be that of data hiding. Suppose we would like to 
transmit a secret image over a noisy and insecure channel. We could divide 
the image information into several shares that are basically innocuous images. 
These images could be transmitted and at the other end, the secret image 
could be reconstructed from the threshold number of shares. Another useful 
application would be that of a military command and control system based on 
the Clark- Wilson security model [11]. Suppose we want the battlefield plans to 
be made only if k out of n commanders agree. In which case, we could divide 
the battle terrain map into n shares and distribute it to the commanders. Only 
if k of them get together can they restore the terrain map and agree to a battle 
plan. In general, our scheme would be advantageous in any situation where a 
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group of mutually suspicious individuals or processes need to cooperate and 
every threshold subset of the group needs to be given the veto power. 

The problem of color image sharing is formally defined as follows. In order 
to transfer a color image X through a public channel securely, the information 
of the color image is divided into n pieces and embedded into images Ii, 
(i = 1, 2, ■ • • , n), and we call the images Ii, (i = 1, 2, • • • , n) as shares. With 
the knowledge of any k(k < n) shares Ii, (i = 1, 2, • • • , k), the restoration of 
the original color I image is easy; with the knowledge of any k — l(k < n) 
shares, the restoration of the original image X is impossible (i.e., any image is 
equally likely to be reconstructed). 



FIGURE 14.1 

Principle of image sharing. 

In Figure 14.1, the left-most image is the original color image that we 
desire to keep as a secret and it is divided into several blocks (subimages). We 
process each of these blocks into n shares in order to create the subimages 
shares. If required, we can compose these shares Ii, (i,= 1, 2, • • • , n) together 
and compute the blocks in the right-most image. Block-based processing is 
done for breaking correlation. Note that our scheme will require a minimum 
of k shares in order for I r to be exactly equal to I s . If less than k shares are 
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used, then I s cannot be restored. The threshold is indispensable in color image 
sharing. 


14.2 State of the Art 

Applying visual cryptography techniques to color images is a very important 
area of research because it allows the use of natural color images to secure 
some types of information. Due to the nature of a color image, this again helps 
to reduce the risk of alerting someone to the fact that information is hidden 
within it. It should also allow high quality sharing of these color images. Color 
images are also highly popular and have a wider range of uses when compared 
to other image types. Many of the techniques presented within this section 
use halftone technologies on the color images in order to make them work 
with visual cryptography. That is why color visual cryptography is presented 
within this section. 

In 1996, Naor and Shamir published a second article on visual cryp- 
tography ’’Visual Cryptography II: Improving the Contrast via the Cover 
Base” [23]. The new model contains several important changes from their 
previous work; they use two opaque colors and a completely transparent one. 

The first difference is the order in which the transparencies are stacked. 
There must be an order to correctly recover the secret. Therefore, each of 
the shares needs to be predetermined and recorded so recovery is possible. 
The second change is that each participant has c sheets, rather than a single 
transparency. Each sheet contains red, yellow, and transparent pixels. The 
reconstruction is done by merging the sheets of participant I and participant 
II, i.e., put the i-tli sheet of II on top of the i-tli sheet of I and the ( i + l)-th 
of I on top of the i-tli of II. 

The two construction methods are monochromatic construction and 
bichromatic construction. In the monochromatic construction, each pixel in 
the original image is mapped into c subpixels and each participant holds c 
sheets. In each of participant I sheets, one of the subpixels is red and the 
remaining c — 1 subpixels are transparent. In each of participant II sheets, 
one of the subpixels is yellow, the other c — 1 subpixels are transparent. The 
way the sheets of participant I and II are merged is by starting from the sheet 
number 1 of participant I, then putting sheet number 2 of participant II on 
top of it, then sheet number 2 of participant I on top of that, and so on. 

The order in which subpixels of participant I are colored red constitutes a 
permutation n on {1, • • • , c} and the order which the subpixels of participant 
II are colored yellow constitutes a permutation a. ir and a are generated as 
follows: 7T is chosen uniformly at random from the set of all permutations on 
c’s elements. If the original pixel is yellow, then n = <r, therefore each red 
subpixel of the i-tli sheet of participant I will be covered by a yellow subpixel 
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of the same position of the i-th sheet of participant II. If the original pixel is 
red, then a(i) = n(i + 1) for 1 < i < c — 1 and er(c) = 7r(l), therefore each 
yellow subpixel of the i-th sheet of participant II will be covered by a red 
subpixel of the same position of the (i + l)-th sheet of participant I except the 
c-th sheet. In practice, the first sheet of participant I is not necessarily stored 
since it is always covered by other sheets. 

A very primitive example of color image sharing appeared in [24] . In this 
example, each pixel of the color secret image is expanded to a block of 2 x 2 
subpixels. Each one of these blocks is filled with red, green, blue, and white 
(transparent) colors, respectively. Taking symmetries into account, 24 differ- 
ent possibilities for the combination of two pixels can be obtained. It is claimed 
that if the subpixels are small enough, the human visual system will average 
out the different possible combinations to 24 different colors. To encrypt a 
pixel of the colored image, round the color value of that pixel to the near- 
est representable color. Select a random order for the subpixels on the first 
share and select the ordering on the second share such that the combination 
produces the required color. 

The advantage of this scheme is that it can represent 24 colors with a 
resolution reduction of 4, instead of 24 2 = 576. The disadvantage is that the 
24 colors are fixed once the basic set of subpixel colors is fixed. 

Another primitive scheme was also presented [29] and extended more 
recently [34]. Verheul and Van Tilborg’s scheme provides a c-color ( k,n)~ 
threshold scheme. This scheme uses the black pixel to superimpose on the 
result of two color pixels, superimposition, if they give a resultant color that 
is not in the original color palette. This can be achieved by making sure the 
superimposed color pixels result in a noncolor palette color, one of which is 
changed to a black pixel or by ensuring that one of the color pixels is changed 
to black before the superimposing operation [10]. Yang and Laih improve on 
the pixel expansion aspect of the Verheul and Van Tilborg scheme and their 
(n, n)-threshold scheme is optimal since they match the following lower bound 
placed on pixel expansion, formulated in [10]: 


J c • 2" 1 — 1 , if n is even 

( c • 2 n ~ 1 — c + 1, if n is odd 


(14.1) 


Hou et al. [18] proposed a novel approach to share color images based on 
halftoning. With this halftone technology, different gray levels can be simu- 
lated simply by altering the density of the printed dots. Within bright parts 
of the image the density is sparse, while in the darker parts of the image, it is 
dense. This is very helpful in the visual cryptography sense because it is able 
to transform a gray-scale image into a black and white image. This allows for 
traditional visual cryptography techniques to be applied. Similarly, the color 
decomposition method is used for color images, which also allows the proposed 
scheme to retain all the advantages of traditional visual cryptography, such as 
no computer participation required for the decryption/recovery of the secret. 

Hou himself also provided one of the first color decomposition techniques 
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to generate visual cryptograms for color images [19]. Using this color decom- 
position, every color within the image can be decomposed into one of three 
primary colors: cyan, magenta, or yellow. This proposal is similar to tradi- 
tional visual cryptography with respect to the pixel expansion that occurs. 
One pixel is expanded into a 2 x 2 block where two color pixels are stored 
along with two transparent (white) pixels. 

However, [21] examined the security of Hou’s [19] scheme, and while the 
scheme is secure for a few specific two-color secret images, the security cannot 
be guaranteed for many other cases. 

Improving this pixel expansion and also working out the optimal contrast 
of color visual cryptography schemes have been investigated [10]. In the paper, 
they prove that contrast-optimal schemes are available for color visual cryp- 
tography (VC) and then further go on to prove the optimality with regard to 
pixel expansion. 

A lossless recovery scheme outlined by [20] considers halftoning techniques 
for the recovery of color images within visual cryptography. The scheme gen- 
erates high quality halftone shares that provide lossless recovery of the secrets 
and reduces the overall noise in the shares without any computational com- 
plexity. Their proposed method starts by splitting the color channels into its 
constituent parts, cyan (C), magenta (M), and yellow (Y). Each channel has 
grayscale halftoning applied to it. Error diffusion techniques discussed in [35] 
are then applied to each halftone channel. A circularly symmetric filter is used 
along with a Gaussian filter. This provides an adequate structure for the dot 
placement when constructing the shares. 

Efficiency within color visual cryptography [25] is also considered which 
improves on the work done by [34, 3] . The proposed scheme follows Yang and 
Laih’s color model. The model considers the human visual system’s effect on 
color combinations out of a set of color subpixels. This means that the set of 
stacked color subpixels would look like a specific color in original secret image. 
As with many other visual cryptography schemes, pixel expansion is an issue. 
However Shyu’s scheme has a pixel expansion of \log 2 c \ , which is superior to 
many other color visual cryptography schemes especially when c, the number 
of colors in the secret image becomes large. An area for improvement however 
would be in the examination of the difference between the reconstructed color 
pixels and the original secret pixels. Having high quality color VC shares would 
further improve on the current schemes examined within this survey, this 
includes adding a lot of potential for visual authentication and identification. 

Chang et al. [6] present a scheme based on smaller shadow images, which 
allows color image reconstruction when any authorized k shadow images are 
stacked together using their proposed revealing process. This improves on the 
following work [32], which presents a scheme that reduces the shadow size 
by half. Chang et al.’s technique improves on the size of the share in that, 
as more shares are generated for sharing purposes, the overall size of those 
shares decreases. 

In contrast to color decomposition, Yang and Chen [33] propose an addi- 
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tive color mixing scheme based on probabilities. This allows for a fixed pixel 
expansion and improves on previous color secret sharing schemes. One prob- 
lem with this scheme is that the overall contrast is reduced when the secrets 
are revealed. 

In most color visual cryptography schemes, when the shares are superim- 
posed and the secret is recovered, the color image gets darker. This is due 
to the fact that when two pixels of the same color are superimposed, the re- 
sultant pixel gets darker. Cimato et al. [9] examine this color darkening by 
proposing a scheme that has to guarantee that the reconstructed secret pixel 
has the exact same color as the original. Optimal contrast is also achieved 
as part of their scheme. This scheme differs from other color schemes in that 
it considers only 3 colors when superimposing, black, white, or one pixel of 
a given color. This allows for perfect reconstruction of a color pixel, because 
no darkening occurs, either by adding a black pixel or by superimposing two 
colors that are identical, that ultimately results in a final darker color. 

A technique that enables visual cryptography to be used on color and 
grayscale images is developed in progressive color visual cryptography [13]. 
Many current state-of-the-art visual cryptography techniques lead to the 
degradation in the quality of the decoded images, which makes it unsuit- 
able for digital media (image, video) sharing and protection. In [13], a series 
of visual cryptography schemes have been proposed that not only support 
gray-scale and color images, but also allow high quality images including that 
of perfect (original) quality to be reconstructed. 

The annoying presence of the loss of contrast makes traditional visual cryp- 
tography schemes practical only when quality is not an issue which is relatively 
rare. Therefore, the basic scheme is extended to allow visual cryptography to 
be directly applied on grayscale and color images. Image halftoning is em- 
ployed in order to transform the original image from the grayscale or color 
space into the monochrome space which has proved to be quite effective. To 
further improve the quality, artifacts introduced in the process of halftoning 
have been reduced by inverse halftoning. 

With the use of halftoning and a novel microblock encoding scheme, the 
technique has a unique flexibility that enables a single encryption of a color 
image but enables three types of decryptions on the same ciphertext. The 
three different types of decryptions enable the recovery of the image of varying 
qualities. The physical transparency stacking type of decryption enables the 
recovery of the traditional VC quality image. An enhanced stacking technique 
enables the decryption into a halftone quality image. A progressive mecha- 
nism is established to share color images at multiple resolutions. Shares are 
extracted from each resolution layer to construct a hierarchical structure; the 
images of different resolutions can then be restored by stacking the different 
shared images together. 

The advantage is that this scheme allows for a single encryption, multi- 
ple decryptions paradigm. In the scheme, secret images are encrypted/shared 
once, and later, based on the shares, they can be decrypted/reconstructed in 
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a plurality of ways. Images of different qualities can be extracted, depending 
on the need for quality as well as the computational resources available. For 
instance, images with loss of contrast are reconstructed by merely stacking 
the shares; a simple yet effective bit-wise operation can be applied to restore 
the halftone image; or images of perfect quality can be restored with the aid 
of the auxiliary look-up table. Visual cryptography has been extended to al- 
low for multiple resolutions in terms of image quality. Different versions of 
the original image of different qualities can be reconstructed by selectively 
merging the shares. Not only this, a spatial multiresolution scheme has been 
developed in which images of increasing spatial resolutions can be obtained 
as more and more shares are employed. 

This idea of progressive visual cryptography has recently been ex- 
tended [14] by generating friendly shares that carry meaningful information 
and that also allows decryption without any computation at all. Purely stack- 
ing the shares reveals the secret. Unlike [13] and [7] which require compu- 
tation to fully reconstruct the secret, the scheme proposed in [15] has two 
types of secrets, stacking the transparencies reveals the first, but computa- 
tion is again required to recover the second-level secret. Fang’s scheme is also 
better than the polynomial sharing method proposed in [26] by Thien and 
Lin. The method proposed in [26] is only suitable for digital systems and the 
computational complexity for encryption and decryption is also a lot higher. 

Currently, one of the most robust ways to hide a secret within an image is 
by typically employing visual cryptography. The perfect scheme is extremely 
practical and can reveal secrets without computer participation. Recent state- 
of-the-art watermarking [8] can hide a watermark in documents that require 
no specific key in order to retrieve it. We take the idea of unseen visible 
watermarks and apply a secure mask to them and incorporate it for use within 
the VC domain, thus improving the overall security that is currently one of 
its weaknesses. 

Weir et al. [31] also provide a mechanism for secret sharing using color 
images as a base. The technique relies on visual cryptography as a mechanism 
for sharing the secret. Many smaller secrets can be embedded within a color 
image and a final share can be created in order to reveal all of the secrets. The 
color image is visually similar to the original image before embedding due to 
the high Peak-Signal-to-Noise Ratio (PSNR) achieved after embedding. 

Another recent novel application for color image sharing and using color 
images for secret sharing was presented by Weir and Yan [30]. Using Google 
Maps, along with its Street View implementation, personally identifiable in- 
formation can be obscured using visual cryptography techniques and can be 
accurately recovered by authorized individuals who may need the information. 
Specifically for law enforcement agencies who many find this type of informa- 
tion helpful for a particular case. This type of practical application is very 
important for the progression of visual cryptography, which presents a unique 
way of using these techniques in a real-world situation. 
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14.3 Approaches for Image Sharing 
14.3.1 Shamir’s Secret Sharing Scheme 

Shamir’s secret sharing scheme is based on the Lagrange interpolation [2]. 
Given a set of points = 0, 1, 2, k), the Lagrange interpolation 

polynomial L k (x ) can be constructed using: 

x> n <i«> 

i = 0 j=0\i^j J 

Given a secret, it can be easily shared using this interpolation scheme. If 
GF(q) denotes a Galois field (q > n), the following polynomial is constructed 
by choosing proper coefficients ao, a i, • • • , ak from GF(q ), which satisfy: 


k 

f k (x) = 5* + ^2 a i X% (14.3) 

i— 0 

where s* is the secret key. The coefficients are randomly chosen over the 
integers [0, q) and the details are provided in [2]. Suppose Si = /(a,;),(* = 
0, 1, • - - ,k), each Si is known as a share and they all can be delivered to 
different persons. 

Now we would like to reconstruct the original secret. Suppose k people 
have provided their shares s.j, (i = 0, 1, • • • , k). The following Lagrange inter- 
polation polynomial is utilized to reconstruct the original secret: 


P k (x ) = V Si 


a — dj 


k 

V. 

i = 0 aj a * 


n 


(14.4) 


where addition, subtraction, multiplication, and division are defined over 
GF(q). 


P k { ai ) = af, i = 0, 1, 2, • • • , fc; s* = P k { 0); (14.5) 

Thus, we can obtain the original secret s*[l][2]. 

14.3.2 Color Image Sharing Based on the Lagrange Interpo- 
lation 

When an image is treated as a secret, we can share the secret based on the 
Lagrange interpolation. We consider the image to be a matrix; and Lagrange 
interpolation is generalized for matrices. 

We assume a grayscale image corresponds to a matrix A. Given ma- 
trix Ai = (a l w h )wxH, where w and h are integer ( w = 1,2,- •• , W; h = 
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1, 2, • • • , H\ i = 0, 1, • • • , k), k is the number of shares. We define the matrix 
operations of Lagrange polynomials with degree k in the Galois field: 

L fc 0r) = ][> fl (14-6) 

X o Xi 

2—0 J 

where (#*, Aj) is the feature point, Ay( (i = 0, 1 , • • • , k )) are matrices of size 
WxH , the elements being nonnegative, Xi is a real number and Xi < Xj (i < j) . 

Our novel idea for color image sharing using Lagrange interpolation is the 
following. We utilize the secret image and a few (< n) other chosen innocuous 
images to build the Lagrange interpolation polynomial. We then construct 
new images based on this interpolation to obtain a total of n images. We now 
can use all the innocuous images and the new reconstructed images as the 
shares of the secret image. And the secret image is not distributed but it can 
be always reconstructed using the requisite number of shares. So our novelty is 
in the construction of new shares based on the secret image and some chosen 
innocuous images. We now provide the details of the scheme. In Figure 14.2, 
assume that the secret image that we desire to share is at the position x = 0. 



(a) l = 2 


(b) l = 3 


FIGURE 14.2 

Image sharing based on the Lagrange interpolation in (a) and (b). 

In Figure 14.2(a), we position an innocuous image at X 2 ■ We can now 
compute many new shares with the parameters in the interval ( X 2 — d,X 2 + d), 
d > 0, (we have used d max = X2 ~ Xo y Without loss of generality, we select the 
parameter at the position x\ as our newly created share (based on 0 and a^)- 
We now consider the images at X 2 and x\ as the shares of the secret image 
at 0. For the reconstruction of the secret, we can collect the two shares, we 
calculate the coefficients of Lagrange interpolation polynomial first and then 
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compute the image at position 0. In Figure 14.2(b), we put the shares in x±, 
X 2 and obtain the secret color image at 0; and in Figure 14.2(b), we put the 
shares at xi, X 2 , X 3 and restore the secret image at position 0. For a color 
image, this operation can be performed for each color channel. Figure 14.3 
shows our experimental results for the Lagrange interpolation scheme of a 
color image. 



(a) Original image and shares 1 and 2 




(b) Original image and shares 1, 2, and 3 


FIGURE 14.3 

(See color insert.) Experimental results of image sharing based on the La- 
grange interpolation in (a) and (b). 

In Figure 14.3(a), the original color image is the secret image to be shared, 
at least two shares are needed to reconstruct the original image, i.e. , it is a 
(2, n ) scheme, thus k = 2. Thus, share 2 has been generated using the original 
color image and share 1 (which is an innocuous image). Now, share 1 and 
share 2 can be distributed independently and the original color image can be 
reconstructed anytime if we obtain both the shares. In Figure 14.3(b), the 
original color image is the secret color image and at least three shares are 
required to restore the secret color image. This is because k = 3, therefore 
it is a (3,n) secret image sharing scheme. Notice that the secret image is 
somewhat visible in the generated shares. We will fix this problem later with 
the block-based approach. 
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However, the Lagrange polynomial based image sharing has a potential 
practical problem. It cannot yield too many shares. This is because the La- 
grange polynomial curve with a high degree has severe oscillations once the 
degree of the polynomial is greater than nine [16]. The consequence of this 
oscillations phenomenon is that it is impossible to constrain the pixel values to 
lie between 0 and 255. As a result, the resultant shares are not proper images 
anymore as shown in Figure 14.4. 



(a) Original image (b) Shares 1 


(c) Shares 2 


FIGURE 14.4 

(See color insert.) The image sharing by using a high degree polynomial in- 
terpolation in (a)-(c). 

In Figure 14.4, the resultant image Figure 14.4(a) is the original secret im- 
age, Figure 14.4(b) is the innocuous image and Figure 14.4(c) is the generated 
share while the rest of the shares are all-white images. We use a polynomial 
of degree 8 for generating Figure 14.4(c). Figure 14.4(c) has obvious color 
overflow problems because some pixel values are more than 255 and some are 
less than zero, hence the image quality is severely degraded. Note that this is 
not a problem in Shamir’s original secret sharing scheme because they con- 
sider the secret to be shared as a binary integer, and thus a share can take on 
any value. In our case, this binary integer has some constraints because they 
denote image pixel values. In order to overcome this serious limitation, it is 
obvious that some form of a piece-wise polynomial interpolation is required 
in order to bound the degree of the polynomial and thus constrain the oscilla- 
tions. We have developed a new color image sharing scheme based on moving 
lines, which is a rational implicit curve. 

14.3.3 Color Image Sharing Based on Moving Lines 

It is well known that the equation of a line in the homogenous form in pro- 
jective geometry [22] is: 


aX + bY + cW = 0 


(14.7) 
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where a, b , and c are not all zero, ( X , Y, W ) are the homogenous coordinates 
of points whose Cartesian coordinates are: 

(x,y) = (X/W,Y/W) (14.8) 

It is obvious that X, Y, W cannot all be zero. Let P denote the triple ( X , Y, W) 
and L denote the triple (a, b, c). We refer to the line L that is: 


{(X,Y, W)\L P = ( a,b,c ) • (X,Y,W) = a X + bY + cW = 0} (14.9) 

Thus, we can see that a point P lies on a line L = (a, b, c) only and if only 
P ■ L = 0 , where P L is the dot product. 

Now we consider the line L containing two points Pi = (X\,Yi, W[ ) and 
P 2 = {X 2 ,Y 2 ,W 2 ), and also the point P at which two lines L\ = (ai,6i,ci) 
and L 2 = ( a 2 ,b 2 ,C 2 ) intersect. Because of the duality principle (of points and 
lines), we have these cross products: 


L = Pi x P 2 , P = Li x L 2 (14.10) 

A homogeneous point whose coordinates are functions of a variable t (i.e. , 
it is parameterized by a variable t) is denoted as: 


P[t] = (X[t),Y[t],W[i\) 

which actually is the rational curve: 

X[t\ Y[t } 

x= WY y = WY 

If the functions are of the following form: 


(14.11) 


(14.12) 


X[t] = Xifalt]-, Y[t) = Yifalt]-, W[t\ = WiUt] (14.13) 

With {<(>i[t]} being a given set of blending function, then equation (14.11) 
defines a curve: 


P[t} = Y J P iU t] ( 14 - 14 ) 

where the homogeneous points are P t = (Xi,Yi, Wi). Likewise, 

L[t] = (a[t],b[t],c[t]) (14.15) 

denotes the family of lines a[t]x + b[t\y + c[t] =0. 

In order to obtain the intersection of two pencils, we notice the following 
four lines L 0 0 , L 0 1 , Li q, and \ from which two pencils are defined: 

Lo[t\ = Lo,o(l — t) + Lo,iL L\ [f] = Li ) o(l — t) + Lipf (14.16) 

The points, at which they intersect for parameter values t = 
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0, At, 2 At, • • • , 1 are on a curve. The parameter t = 0, At, 2 At, ■ ■■ , 1 is adap- 
tively given and it may take any real number value in the interval [0,1] for a 
piece of curve and it also can be extended to the infinite interval [— oo,+oo] 
for the whole curve. The curve turns out to be a conic section, which can be 
expressed as a rational Bernstein-Bezier curve P[t\ as follows: 

P[i]=L 0 [i]xLi[i] (14.17) 

It is clear that P[t] is a quadratic rational Bezier curve [27] [28] whose 
control points are: 


Pa — To, 0 * Ti n. P-\ — 


Tq,o x Ti,i + Tq.i x L 


1 , 0 ) r i 


0,1 


-u,o 


P 2 = T 0 ,ixTi,i (14.18) 


The graph of a quadratic curve generated by moving lines is shown in 
Figure 14.5(a). 



(a) The graph of a quadratic curve (b) The graph of a quartic curve 

FIGURE 14.5 

Intersection of two pencils of lines in (a) and (b). 

In general, the curve comprising of Lop, Top, Top, and Lip, Lip is: 

To[t] = To,o(l — t) + 2Lo,i(l — t)t + Lopt 2 , Ti[t] = Ti i o(l — t) + Tipt (14.19) 

then P[t] = L 0 [t] x Li[t\, t £ [0, 1] is a cubic rational Bezier curve [16]. 

Without loss of generality, the moving lines consisting of L 0 p, T 01 , • • • , 
To )P , and Lip, Tip, , L\ q are. 

p q 

L 0 [t\ =Y J LiP BP i{t),L 1 [t} = Blit) (14.20) 

2—0 2—0 
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FIGURE 14.6 

Image sharing scheme based on moving lines. 


then P[t\ = Lo[t\ x L\\t], t £ [0, 1] represents a rational Bezier curve of degree 
p + q as shown in Figure 14.5(b) [16]. 

As in the case of Lagrange interpolation, we now construct the scheme of 
image sharing based on moving lines as shown in Figure 14.6. In Figure 14.6, 
the ^-coordinate depicts the given position of the original secret color image, 
the j/-coordinate indicates the values of the gray-scale pixel value, t is the 
parameter for moving lines generation, and x* is the position of the new 
computed share. For image sharing, we compute the shares using the above 
implicit curve. We now present the detailed steps for our moving lines based 
on the color image sharing scheme. 

Steps of sharing a color image: 

1. Suppose we are given one secret image Iq to be shared, k + 1 images 
Io, Ji, • • • , Ifc as the innocuous images and a group of corresponding 
parameters xq, xi,- ■ ■ , Xk ( xo < x\ < ■ ■ ■ < Xk) as input; 

2. Calculate an arbitrary new share corresponding to a parameter 
within the interval of the given parameters ( X\,Xk ); 

3. The images (greater than k) J 0 , Ji, h- 1 , I p , /*,/»+ 4; 
0<i— l<p<i<k and their corresponding parameters Xq, X\, 

• • • , Xi- 1, Xp, Xi, X i+1 , ■■■ , Xk (x 0 < Xi < • • • < Xi - 1 < Xp < Xi < 

%i+i < • • • < Xk) are the output computed image shares. 

Steps of reconstructing the color image: 

1. Select k image shares Jo, 4, • • • , 4 and their corresponding position 
parameters xq, X\, • • • , Xk ( Xo < x\ < ■ ■ ■ < Xk) and the position 
parameter of the color image Xq as the input; 

2. Calculate the implicit curve corresponding to pixels in each share 
according to the moving lines scheme P[t] = L 0 [t] x Li[t], t £ [0, 1]; 

3. Reconstruct the secret color image by the scheme of moving lines 
at the position of xq as output. 
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Note that each of the steps has to be applied separately for each color 
channel. The use of a rational curve has several advantages, such as it does 
not have the oscillations phenomenon of polynomials with a high degree; a 
rational curve is easy to be controlled and is able to express conic curves. Also 
a polynomial curve with a high degree cannot guarantee that the interpolation 
values can be constrained to a given range [16] . Thus, when a rational curve is 
employed to share a color image, the scheme based on moving lines yields more 
shares than that of the one based on the Lagrange interpolating polynomial. 
With more shares, the secret color image can be shared in a more secure 
manner with greater flexibility. However, this greater flexibility comes at an 
increased cost of computation compared to that of the Lagrange interpolations 
scheme. 

14.3.4 Improved Algorithm 

If we carefully examine Figure 14.3, we can see that the profile of the se- 
cret image is visible in the constructed image shares. The reason is that the 
correlation of the secret image is not broken during the image sharing pro- 
cess. So far, we selected only one X-position parameter for the secret image, 
thus only one share (i.e., the newly created one) is closely related to the se- 
cret image and the other shares are totally independent. Thus, the innocuous 
images do not contribute towards image hiding. We now modify the earlier 
approach slightly to make all the shares involved in data hiding by utilizing a 
block-based approach with multiple parameters: 

Steps of block-based image sharing: 

1. Divide the secret image into blocks. 

2. Designate different parameters (i.e., different innocuous image po- 
sition) for each block. 

3. Share the secret image using the earlier approach. 

4. Write down the parameters and positions embedded in the corre- 
sponding shares of each block for secret restoration. 

The restoration handling is the inverse procedure of the encoding proce- 
dure. 

In order to clearly explain the scheme, we illustrate the improved approach 
in Figure 14.7. In Figure 14.7, the secret image is divided into four blocks, each 
block is embedded into the given innocuous image share at a different spatial 
position. The secret image can be reconstructed by applying the scheme block- 
wise again. This method effectively breaks the correlation of the original secret 
image with the secret image being divided into many blocks and these blocks 
being hidden in different shares at different locations. Thus, the secret image 
is no longer visible in the shares. 
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FIGURE 14.7 

Improved algorithm of image sharing. 


14.4 Experiment and Evaluation 

Both of the algorithms proposed in this chapter can theoretically be employed 
for image sharing, but actually they are different in terms of practical imple- 
mentation. Color image sharing based on Lagrange interpolation allows for 
only a limited number of shares due to the oscillations phenomenon. Color 
image sharing based on moving lines can theoretically generate an unlimited 
number of shares. In practice, generating more shares will require more com- 
putation. Thus, as a trade-off, we usually share a color image into at most five 
shares. 



FIGURE 14.8 

(See color insert.) The experimental results of image sharing by moving lines. 

We now present some experimental results on images of size 128x128. The 
shares and original secret image based on quadric curves of moving lines are 
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FIGURE 14.9 

(See color insert.) The experimental results of image sharing by moving lines. 



FIGURE 14.10 

(See color insert.) The experimental results of image sharing by moving lines. 


shown in Figure 14.8, which is a (2 ,n) sharing example. In Figure 14.9, we 
illustrate a (3 ,n) scheme based on cubic curves of moving lines. 

Figure 14.9 is the result of (3, n ) scheme based upon moving lines to share 
a given original image, with share 1 and share 2 being innocuous. Share 3 is 
the new computed share. By using shares 1, 2, 3, and their parameters, the 
original color image can be restored. 

Figure 14.10 is the result of a (4, n) scheme based on a moving line to 
share a color image by given original secret image, share 1, share 2, and share 
3. Share 4 is the new computed share. When shares 1, 2, 3, 4, and their 
parameters are used for the moving lines based scheme, the original color 
image can be perfectly restored. 

For a sensitive application, it is better to compute the shares by perform- 
ing block-by-block (e.g., 8x8 pixel blocks) processing. The advantage of such 
an approach is that distributing the reconstructed blocks into the various in- 
nocuous images can break the correlation of the secret image in the image 
share. Thus, instead of taking n — 1 innocuous images and creating the n-th 
share (which can possibly reveal some correlations), we can take n innocuous 
images and distribute the secret image blocks within them. In fact, the secret 
color images need not be of the same size as that of the shares. Actually, if the 
shares have a larger size, the hiding of the color image will be more secure. 

Figure 14.11 shows an example of breaking the correlation between neigh- 
boring blocks of the secret image. In this (4, n) image sharing scheme, we have 
divided the original image into four equal-sized rectangular blocks and have 
shared these blocks using a quadric curve generated by the moving lines tech- 
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FIGURE 14.11 

(See color insert.) Breaking the correlation of neighboring blocks in an image. 


nique. What is different here from the earlier examples (where we created a 
whole new image as a share) is that we embed the information of each rectan- 
gular block into one of the image shares. The embedded information of share 
1 is in the lower-left corner, that of share 2 is in the upper-left position while 
that of share 3 is embedded is in the upper-right region, and that of share 4 
is in the lower-right corner. Thus, the information of the original secret image 
is shared among all the image shares. While this example is a simple illustra- 
tion of how the correlation can be broken, it is clear that more sophisticated 
secret image subdivision and sharing schemes can be devised using the same 
principle. 


14.5 Conclusion 

In this chapter, we introduce the novel concept of color image sharing based on 
Lagrange interpolation and moving lines. The security of secret sharing is built 
upon the computation of polynomials. Given enough shares, the coefficients 
of the interpolating polynomial can be exactly determined. However, if an 
attacker does not possess the threshold number of shares and the image shares, 
he will not be able to reconstruct the polynomial. Thus, he will not able to 
restore the secret image properly. 

Secret sharing based on Lagrange interpolation is often utilized to share 
binary strings, but it is difficult to use for color image sharing since it yields 
only a limited number of shares. We therefore have developed a new color im- 
age sharing scheme based on moving lines that does not have that limitation. 
An implicit curve generated by moving lines is a rational curve; we believe it 
can therefore be directly applied for sharing compressed-domain images. 

Our future work will focus on further investigation of color image sharing 
in the compressed domain. The possible research directions in the future are: 

1. Color image sharing based on compressed domain processing. Ideas 
related to DCT, DFT, and DWT can be employed in color image 
sharing. 
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2. Color image sharing based on visual cryptography. If visual cryptog- 
raphy could be implemented in color images, we could share color 
images with visual cryptography. Since visual cryptography is per- 
fectly secure, color image sharing based on visual cryptography will 
be extremely robust. 
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15.1 Introduction 

The concept of secret sharing comes from the method of secret key manage- 
ment and was first seen in the following works [1, 7]. The secret’s owner wants 
to share the secret with other participants, but no participants can obtain the 
secret alone. When some of the participants work together, the secret is then 
revealed. From a technical viewpoint, this secret sharing scheme may also be 
referred to as the ( t , n)-threshold, where t denotes the threshold value that 
will reveal the secret and n is the total number of holding shadows. In this 
method, when a secret is given, it must be divided into n shadows and it is 
then reconstructed by t or more shadows, possessed by the shadow holders; 
no information can be conjectured by fewer than t shadows. In the wake of 
this cryptographic application proposal, many related methods were further 
proposed to enrich secret sharing diversity in both theoretical and practical 
arenas [4, 6, 8, 12]. 

Visual security was proposed by Naor and Shamir [6] in 1994, where an 
image could be reconstructed by superimposing two shares. The shares issued 
in this scheme are made up of random binary patterns. The target secret, rec- 
ognized by the human visual system, is finally stacked by the (t, n)-threshold 
scheme. One of the main advantages, in this scheme, is that it does not require 
complicated computations, which traditional numeric cipher-text in secret de- 
cryption does, while the sizes of the enlarged shares, and target secrets are left 
the same. Thien and Lin [8] proposed an applied secret image scheme for im- 
age embedding to improve upon Naor and Shamir’s method. The concealment 
of a secret image avoids cipher-based attacks on the basis of stego-image im- 
perceptibility. In 2006, Horng et al. uncovered another way to cheat the (t, n)- 
threshold under visual cryptography (VC) applications [3]. In their proposal, 
a scenario was successfully put forward showing that shareholders were able 
to collaborate with each other by sending fake shares to other shareholders. 
Accordingly, the final target secret image was different from the genuine one, 
corrupting the secret sharing system. 

Steganography is a kind of data hiding technique that provides another 
method of security protection for digital image data. The purpose of steganog- 
raphy is to embed secret data in preselected meaningful images, called cover 
images, with people being visually unaware of the secret’s existence. Numer- 
ous schemes have been developed to achieve successful data hiding [2, 5] . To 
prevent the fake stego-image from the dishonest participants, Lin and Tsai 
[4] authored an authentication-based steganography study, where their detec- 
tion technique tested whether the offered shares were genuine or not. In their 
scheme, parity checks were applied to prevent the modified shares from mali- 
cious attacks. Later on, in 2007, Yang et al. [12] enhanced the mechanism of 
Lin and Tsai by proposing a revised scheme in which more detailed fake shares 
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were created so that they would be detected by those malicious shareholders 
in the target secret image (t, n)-threshold system, thus acting as a deterrent. 

In 2008, Wang et al. [10] took advantage of the CRC (Cyclic Redundant 
Code) in conjunction with the hash function to make authentication-based 
steganography more robust, in order to prevent the attacks of fake share of- 
ferings. In addition to making it more robust, both the capacity and the image 
quality remain comparable to the scheme suggested by the scheme in [12]. In 
this chapter, we introduce the polynomial-based image sharing scheme by 
reviewing some preliminaries and related works and depicting Wang et al.’s 
approach. Moreover, some improvements of Wang et al.’s approach are pro- 
posed in this chapter. 

The presentation of this chapter is organized as follows. In Section 15.2, 
the concept of the polynomial-based sharing scheme is introduced. In Section 
15.3, we introduce some preliminaries and related works about the polynomial- 
based image sharing scheme. Wang et al.’s scheme and its improvements are 
presented in Section 15.4. Observations and experiments of benchmark images 
are presented and discussed in Section 15.5. Finally, conclusions are offered in 
Section 15.6. 


15.2 Polynomial-Based Sharing Scheme 
15.2.1 Shamir’s Secret Sharing Scheme 

A (f , n)-threshold scheme is a method of sharing a secret among n participants 
such that any subset consisting of t participants can reconstruct the secret, 
but no subset of smaller size can reconstruct the secret. The first method 
was provided in 1979 by Shamir [7] and is known as Shamir’s secret sharing 
scheme. In the initial state, a dealer chooses a large prime number p, and makes 
p public. The following calculation is performed on Z p : A secret, s £ Z p exists, 
so the dealer randomly generates a (f-l)th degree polynomial, in Z q : 

q{x) = x + q±x + q 2 X 2 + ■ ■ ■ + qt-iX^ 1 (modp) 


where g(0) = s is the secret. The dealer distributes the shadow, y * = q(xi)(mod 
p) to node Pi, where Xi is the ID number for Pj. 

Suppose that t participants get together to reconstruct the polynomial. 
Also, assume that their pairs are (x\,y{), (x 2 , 2 / 2)1 •••, ( Xt,yt )■ The polyno- 
mial q{x) can be reconstructed by solving the following equation: 


1 X\ 

1 x 2 
1 x t 


x 

X 


t — 1 
1 

t - 1 
2 


X 


t-1 

t 



s 


’ yi " 


Qi 
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2/2 


. Qt- 1 . 


. 2/t 


( mod p) 
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The equation has a unique solution if the determinant of the matrix is nonzero 
mod p. It can be shown that the determinant of the matrix is nonzero mod p 
if all Xi, i = 1, 2,- • • , t, are different. After the polynomial is reconstructed, 
the secret s is obtained by the output of g(0). 


15.2.2 Lagrange Interpolation Scheme 

An efficient method to obtain the sharing polynomial / is to use the Lagrange 
interpolation. Assume that the pairs (xi,yi), ( #2)2/2 ),■ ■ ■ , ( x t ,y t ) are used to 
reconstruct the polynomial q(x). For k = 1, 2,- • • , t, let 

l k(x) = U i =i^kfc=t i mo dP 

We know that 


. , . _ , 1, when k = j 

k\ x j) { o , when k^j 

Then, the Lagrange interpolation polynomial is formed as follows: 


h'x = ELi Vkhmod p 


Because y t = q'(xi)(modp ) for i = 1, 2,- • t and q'(x) has degree t — 1, 
q'( x) is equal to the polynomial q(x). Finally, the secret s can be obtained by 
evaluating q(x) at x = 0. That is, 

s = ELi Vk HU*# P 

In fact, all coefficients in q(x) can be seen as secrets. We show an example 
for the Lagrange interpolation polynomial. 


Example 1. 

Take a (2,4)-threshold scheme. In the share generation phase, assume that 
the pixels of the target secret image S indexed in order of left-to-right and 
top-to-down is Si, I = 0, 1, 2, • • • , n. The first two pixels, for instance, Sq = 
100 and S i = 200 are set in this case. First of all, a polynomial of q(x) = 
200# + 100 mod 251 is given according to the S'-s. Compute the shares y' ,s 
associated with each participants as y\ = q{x i=l) = 49, = q( #2=2) = 

249, 2/3= q(x 3=3) = 198, and 2/4 = q{xn=A) = 147, where x\s are the identity 
numbers of the four participants. Next, consider the recovery of the pixels of 
the target secret image in this case. In the (2, 4)-threshold scheme, any two 
participants who own the shares y'^s can gather to recover the secret, for ex- 
ample, the participants nos. X2 and X4. There are two pairs of ( X 2 , 2/2) = (2, 
249) and (aq, 2/4) = (4, 147) offered from the participants. In such a way that 
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a polynomial of q'( x) is constructed as follows: 

g{x )={ 249 x j*; + 147 x j|^)rnocZ251 

=(249 x (-2)" 1 x (a; - 4) + 147 x (2)” 1 x (x - 2))mod251 
= (20Cte + 100)mod251 

Following up the result, the first two pixels of the target secret image, So 
= 100 and S) = 200 are obtained from the coefficients of q'(x) = 200x + 100 
mod251. 


15.3 Preliminaries and Related Works 

15.3.1 Thien-Lin Scheme 

The (t, n)-thresholcl scheme in visual cryptography was proposed by Naor 
and Shamir [6], where the target secret (image) could only be recognized by 
the human eye if there were exactly t or more than t share-images stacked. 
However, the share-images generated could only reveal one target secret. When 
there are more than 2 target secrets, the numbers of share-images required, 
increases. As a result, the occupied share-images, held by participants, also 
increase. Inspired by these observations, Thien and Lin (Thien-Lin scheme) 
[8] proposed a specific method to accommodate a higher number of share- 
images, with the normal storage requirements, using LaGrange polynomial 
construction. In this method, there are a total of n share-images, with each 
of them being only j times the target secret image. This is also done in the 
(£, n)-threshold scheme. 

15.3.2 Lin-Tsai Scheme 

In [4], Lin and Tsai (Lin-Tsai scheme) proposed a scheme of sharing im- 
age, where the requirements of capacity and detecting ability are further 
considered when compared to the study of [8]. Similarly, a polynomial of 
q(x)=(a o + a\X + a2X 2 + • • • + cq_ iX* -1 ) of degree t- 1 is applied upon the 
concept of the (t, n)-threshold scheme. The q(x) is then devised for exact re- 
construction when t pairs of (xi, q(xi)) are offered among n share holders, 
where Xi is one of the pixels of a pixel-value and q(xi) is the share held in 
the share holder. Accordingly, the pixels of the target secret image can be 
obtained from the coefficients of the new one of q'(x) via the (£, n)-threshold 
polynomial construction. The procedures in [4] are briefly given as follows: 
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x t=(x n ,x l2 ,-,x a ) 


v l =(v,i,v l 2 ,-,v /8 ) 



FIGURE 15.1 

The format of B J , where ay, Wi, ty, and it, are represented as binary pattern. 


Notations: 

q(x): The ( t — l)-degree polynomial of q(x) = (a o + a\x + a 2 X 2 + ... + 
at-iX t ~ 1 )mod p, where p = 251. 

S: The target secret image with the size of m x to. The pixel S', G [0, 250] in 
S, 1< i < m 2 . It is caught by up-to-down and left-to-right in order. 

If The jth cover image with the size of 2 to x 2 in pixels. There are to 2 blocks, 
B^s, where each one is the size of 2 x 2 containing four pixels as ay, uy , 
Vi, and Uj in the order of left-to-right and up-to-down and 1 < i < to 2 and 
1 < j < n. The pixel format of is shown in Figure 15.1. 

- ~ / 

If The jth stego-image with the size of 2 m x 2m. There are to blocks, R, ? s. 

Bij is stego-block when the secret is embedded the Ry. The corresponding 
pixels in B t j to R,y is ay, wi,, ty, and u,, respectively. 

£y: Generate a random bit-string with the form of ( ■ ,b m 2), where 
1< i < to 2 . 

The procedure to generate the stego-image, named as Proc-Lin-Tsai, is 
briefly given in the following: 

Procedure Proc-Lin-Tsai 

Input: S, I j, j = 1, 2, ■ ■ ■ , n. 

Output: /, j = 1, 2, • • • , n. 


Step 1. Generate the random bit string (61, & 2 > • • • , h m i). 

Step 2. Set a$=Si, i € [1, to 2 ]. For each Si chooses a (t— l)-degree polynomial 
q(x)=(ao + a\X + a^x 2 + • • • + mod p, where randomly choose t - 1 

value ai, 02, • • • , at - 1 under the modulo p. Calculate jy = qi(xi), where x , 
is obtained and defined from x , in the and represent p,: as the bit string 
with the form of y t = (y a , y i2 , ■■■ , y i8 ). 

Step 3. Generate the stego-block, B, :l , comprised of the four bit strings as 

Xi — (Xu, X,2, , X-i 8 ), 

Wi = (wn,Wi 2 ,--- ,Wi 5, 6/.j, yn,yi 2 ), 
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.r, 


v, = ( v /t * v /: > ■ "> v, 5 , y a ,.v,4 , y B ) 

u, =(«,„«, 2 , -,a 15 .y,4.y, 74'#) 


FIGURE 15.2 

The format of stego-block B tJ with the size of 2 x 2 gray-level pixels. 


i,=( x n ,x l2 ,-,x lt ,y n ,y l2 ) 


II 

S' 

en 

0 

II 

_e 


FIGURE 15.3 

Stego-block B KI used in Yang et al. which is revised from Figure 15.2, where 
hash is used in the pixel of Wi = (■ Wn , • • • , Wi 5 , hi, yi 3, yi 4). 


A — (Vil , Vi2 j ' •,'rib-i yiQiyi7iyis)i 

and Ui — (riji , Ui 2, , n^, ym, yvj , 

where bi.i is the parity bit, which is chosen to make Wi including the cor- 
responding bit-string The format of stego-block B i: j is shown in Figure 
15.2. 

Step 4. Collect Bij generated in the Step 3 to create stego-image Ij. 

15.3.3 Yang et al.’s Scheme 

As observed from the Lin-Tsai scheme, the fake shares can be easily 
made by the manner of fixing the parity bit b For example, if a*= 
{wn,Wi 2 ,- ■ ■ ,w i5 ,b' i ,y % i,yi 2 ) = (0, 0, 1, 1, 1, 0, 1, 1), the parity bit b\ is all the 
same when the original Wi is changed to a new Wi as u>i = (1, 0, 1, 1, 1, 0, 0, 1). 
In such a way, the malicious attackers can easily modify w/ s in the stego- 
image to pass the authentication detection. As a result, the revelation of the 
target secret image is not a right one. Next, Yang et al. [12] proposed a revised 
version to set a new check function, e.g., hash function, instead of parity bit 
in [4]. The stego-block B^ in [4] is then revised as the format shown in Figure 
15.3. As analyzed in Yang et al., the probability of passing the detection with 
the fake share offers is (|) m ”. 

15.3.4 Inverted Pattern LSB Scheme 

In order to conceal the existence of shadow data, steganographic methods 
are used to keep the shadows imperceptible. The steganographic method is a 
kind of data hiding technique that embeds secret data in preselected mean- 
ingful images, called cover images, with people being visually unaware of the 
secret’s existence. One common technique to achieve the data hiding is the 
LSB-based approach, in which secret data are embedded by directly replacing 
the least significant bits (LSBs) with equal bits of the secret for each pixel. 
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Moreover, some papers applied various strategies to improving the quality 
of stego-images generated by LSB-based approaches. In 2008, Yang [11] pro- 
posed an Inverted-Pattern-LSB information hiding algorithm (IPLA for short) 
to further highlight the quality of the stego-image. His method combines the 
idea of processing secret messages before embedded and processing the stego- 
image after embedding. Before embedding, the secret is transformed into a 
suitable format so as to benefit the next embedding step. Moreover, the bits 
that are used to record the transformation are the critical key in the course of 
the secret revelation. The IPLA algorithm is shown below, which was applied 
in Wang et al.’s scheme. 

Inverted-Pattern-LSB Algorithm (H, S, k, n ) 

Input: A cover image H and a secret string S for /c-bit LSB substitution, z is 
the number of sections. 

Output: A stego-image and an inverted pattern P. 

Step 1. Partition both H and S into z sections evenly. Let H = 
H 0 , , H z _ i, S So, , S z —\ and P Ro: Rh ^ Rz— i, 

where R is the replaced string of H. Also, let the inverted pattern P = 
POiPi: • • • ,Pz- 1 , where pi is a bit, for i = 0, 1, ■ • • ,2—1. 

Step 2. For * = 0 to 2 — 1 
If MSE SiRi < MSE s ~ R . 

Then Pi = 0 
Else Pi = 1 

Step 3. For * = 0 to 2 — 1 
If Pi = 0 

Then Embed Si into Hi 
Else embed S t into Hi 

Step 4. Return the inverted pattern P. 


15.3.5 Scalable Secret Image Sharing 

The conventional secret image sharing (SIS) scheme, such as the Thien-Lin 
scheme [8], only has the threshold property that recovers either the entire 
image or nothing. For the (t. n)-SIS scheme, the target secret image could only 
be reconstructed by only t or more than t qualified participants. This limits 
its possible applications. Recently, Wang and Shyu recommended adding the 
scalable decoding capability (the scalability) into the threshold scheme [9]. The 
so-called scalability is that the amount of secret information is proportional 
to the number of shadows used in reconstruction. Wang and Shyu constructed 
a polynomial based (2, n) scalable SIS (SSIS) scheme, which not only had the 
threshold property but also the scalability. The clarity of an image in [9] is 
measured in terms of three modes: the multisecret mode (spatially partitioning 
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the target image into disjoint subimages), the priority mode (dividing the 
target image according to the bitplanes), and the progressive mode (combining 
the multisecret mode and the priority mode). To extend Wang and Shyu’s 
(2, n)-SSIS scheme, Yang and Huang proposed (£, n)-SSIS schemes where a 
qualified set of participants consists of any t participants [13]. Two approaches 
were proposed for a general construction for any t, 2 < t < n. For t = 2, 
Approach 1 has the lesser shadow size than Wang and Shyu’s (2, n)-SSIS 
scheme, and Approach 2 is reduced to Wang and Shyu’s (2, n)-SSIS scheme. 
The following is the shadow constructing algorithm of their Approach 1. 


Shadow Constructing Algorithm 

Input: a secret image O. 

Output: n shadows Si, i = 1, 2,- • • , n. 


Step 1. Divide image O into 
one of the three modes. 


^ subimages O x , x = 1. 2, • • • , 



by 


Step 2. For every image O x , use a polynomial-based (£,£)- SIS scheme to cre- 
ate t subshadows ( O], ,0^., - ■ ■ ,O x ). 

Step 3. Set Si = S 2 = ■ ■ ■ = S n = <I>. 


Step 4. Choose a binary matrix B nt = [bij]. 

Step 5. For j = 1 to ^ ™ ^ 

Set y = 1; 

For i = 1 to n 


If bij = 1 then 0^=0% and y = y + 1. 
else O l j = ( &. 


Step 6. Si = U > 


n 
t 

f=i 


0 \, *=1,2,- • • ,n 


The binary matrix B n t = [bij] is a n x 


n 

t 


matrix, where bij G [0, 1], 


1 < z < n, and 1 < i < . Every column vector has a Hamming weight 

t. For example, the matrix B n t =Bi i of a (3, 4)-SSIS scheme is 


' 61,1 

b \,2 

frl,3 

&1,4 


' 1 

1 

1 

0 ' 

^2,1 

&2,2 

^2,3 

^2,4 


1 

1 

0 

1 

^3,1 

&3,2 

&3,3 

^3,4 


1 

0 

1 

1 

^4,1 

^4,2 

^4,3 

^4,4 


0 

1 

1 

1 
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The corresponding matrix [O*] is created as follows. 


r 6! 

of 

of 

Of 1 


r o\ 

Of 

Of 

(t> 

of 

of 

of 

Of 


Of 

02 

0 

of 

Of 

62 

of 

Of 


Of 

<t> 

Of 

Of 

L of 

61 

of 

of J 


<t> 

Of 

Of 

Of 


Then, four shadows Si, S2, S3, and S4 are generated as follows. 
Si = 0{ U Of U Of U 0\= 0{ U Of U Of U </>=Of U Of U Of; 

s 2 = o\ u o\ u of u of= o\ u of u <t> u o\=o\ u o\ u of; 

S3 = 6? u of u of u of= Of U </> u of u of =o? u of U Of; 
s 4 = of u of u of u of= ^ u of u of u of =of U Of U Of; 


15.4 Wang et al.’s Scheme 

In this section, we describe in detail Wang et al.’s scheme [10] to introduce 
the standard method of polynomial-based image sharing. Some notations in 
Wang et al.’s scheme have been trimmed for easy description. Also, the Galois 
Field GF( 2 8 ) operations are applied to their scheme such that the all gray- 
level values 0~255 can be completely represented. Therefore, the secret image 
is completely lossless. The detailed approaches in Wang et al.’s scheme are 
introduced in the following subsections. 

15.4.1 Secret Image Sharing 

Based on the study in the literature [8], a secret image sharing technique was 
applied in our scheme. In their proposal, the size of shadows could be dra- 
matically reduced, with n shares being embedded into n different host images 
to avoid the attention of hackers. However, if malicious participants deliver 
fake stego-images, the receivers may recover a fake secret image, thus mislead- 
ing those participating in the secret sharing scheme, due to poor detection. 
Thus, yet another secret sharing function was invented, that we also applied 
in our proposal, using detection authentication to enhance security. Below, 
a revised algorithm is presented to achieve both high capacity and extended 
applications, where participants can recover two or more secret images from a 
stego-image. The notations for the Revised Algorithm of High-Capacity and 
Applications (RAHA for short) are given prior to all the steps shown. 
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S: The target secret image with size m x to. 

t: More than or equal to t shadows possessed by the participants that can 
recover the target secret image. 

n: The number of participants. 

Si'. Each pixel of the target secret image S,i = 1, 2, ■ • • , in 2 . 

Bi j-. The gth block (size of 1 x 8) in the jth cover image, where j = 1, 2, • • • ,n 

r 2 1 

and g = 1, 2, • • • , . Each block is made of 8 pixels. 

Bg d j- The dtli pixel of block B t j. The bit string of each pixel B'' d - is shown 
as the form (xdi , Xd 2 , ■ ■ ■ , Xd 7 , Xds) where 1 < d < 8. 

Bg j\ The gth block in the jth stego-image. 

f y. The feature value of the jth stego-image (or the jth cover image) when the 
block Bg d j ( orB g j ) is processed, where the stego-image size is of 2m x 2 to. 
fj = (xn,Xi 2 ,Xi 3 ,Xi 4 ,X 2 i,X 22 ,X 23 ,X 24 ,) is created from the first two pixels 
in block Bg d j(orB gj :), for j = 1,2, ••• , n. If fj is equal to one of feature 
values /i,/2)'“ ifj- 1 ) keep looking at the next possible pair of pixels in 
block Bg d j (orBgj) following a fixed order. (Note that there are (7(8,2) x 2 
= 56 possible choices in a block.) 

PV yyp \ The gth pixel in jth shadows, g = 1,2, ••• , ^ and j = 
1, 2, • • • , n. The bit-string format of PV.y j 9) is {y g i,y g 2 , ■ ■ ■ , y g s)- 
p: 256 for the Galois Field GF( 2 8 ). 

Revised Algorithm of High-Capacity and Applications (RAHA) 
Part I: Aim at the high capacity approaching: 

r 2 ~i 

For <7 = 1,2,--- , TJ j- , do a loop as follows: 

Step 1 . Generate the polynomial q g (x) of t — 1 degrees as follows: 
q(x) = (a 0 + a\X + a 2 x 2 + ... + a z - ix 1 ^ 1 ) 

where ao = Si, a± = Si + 1, ■ ■ ■ , Ot_i=S'j+t_i, i = (g — 1 )t, and all operations 
are over the Galois Field GF( 2 8 ). 

Step 2. Get block B g j from the jth cover image. Set fj as the feature value 
of block B g j,j = 1,2,--- , n. 

Step 3. Compute PV ji/f' 1 = q g (fi),j = 1,2, ...,n. 

Step 4. Assign each PV to the jth shadow, j = 1, 2, • ■ ■ , n. 
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Target secret image 
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s , 
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rr.^-1 











Shadow I Shadow 2 


FIGURE 15.4 

Demonstration of steps in RAH A. 


The steps stated in RAHA are also demonstrated in Figure 15.4. 

Part II. Aim at the recovery of the original secret image. 

Step 1. Collect at least t shadows among n shadows. Renumber t of them as 
1, 2, • • • , t in order. 


For g = 1,2,- 


, do a loop of the following steps: 


Step 2. Chose the t feature value fj,j = 1, 2, • • • , t forms the collected stego- 
images. 

Step 3. Let Xj = fj, for j = 1, 2, • • • ,t. Reconstruct q g {x) by using the pair 
of (xj,PV -Pj 9 ^) as follows: 

= EL i p V-y[ 9) n-=i j¥ 6 S] modp 

Step 4. Restore t pixels of the secret image from the t coefficients in the 
polynomial function q g {x) = (do + a\X + • • • + a t _ i# 4-1 ). 


15.4.2 Set-Up Authentication 

In Thien and Lin’s proposal [8], the size of shadows could be dramatically 
reduced, with n shares being embedded into n different host images to avoid 
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the attention of hackers. However, if malicious participants deliver fake stego- 
images, the receivers may recover a fake secret image, thus misleading those 
participating in the secret sharing scheme, due to poor detection. Thus, yet 
another secret sharing function was invented in Wang et al.’s scheme to en- 
hance security by introducing an authentication procedure. The CRC (Cyclic 
Redundancy Code Check) and hash function are therefore considered to pre- 
vent the fake shares from the malicious participants who offer in the course of 
revealing the secret image, where the CRC is implemented by CRC-8. Based 
on the CRC adoption, once the participants receive the stego-image, the CRC 
will be launched to check all pixels in the stego-image prior to the reconstruc- 
tion of secret image. The CRC-based detecting authentication procedure for 
each block in the stego-image is presented as follows: 

Step 1. Let G(x) be the polynomial generator. Set /Reset the authentication 
code of CRC-8 as C g = (c gl ,c g2 , • • • , c g8 ) = “00000000,” g = 1, 2, • • • , . 

MAC (Message Authentication Code) with hash implementation is used 
as H k (Bgj\\g\\ID stego _ image \\y g8 ), where K is a secret key. Set B(x) = 

( B g ,j\\Hk(B gtj Wg\\IDstego-image\\y g s))(x ), where B gJ is the stego-block, 
and ID stego _i mage is the identity of a stego-image, i.e., the block message 
B g j is then followed by the MAC of H k {B g ^\\g\\ID stego _ irnage \\y g8 ). 

Step 2. Obtain remainder polynomial R{x) = B{x)modG{x) . 

Step 3. Assign the coefficient of R(x) to C g . 

Step 4. Store C g to the block B g j of the stego-image. 

Step 5. Compare the R(x) and C g . If the result is the same, the block B g j 
of the stego-image is a legal one. Otherwise reject it whenever the compared 
result is different. 

Example 2. 

Consider a gray-level block with a size of 8 pixels. Assume that the B g j = 
’’A1A2A3A4” (it is caught by up-to-down and left-to-right in order), where C g 
= ”00000000”, and the output of HMAC is H k (B gtj \\g\\ ID stego _ image \\y g8 ) 
= ” D08932564F74499D4EC45CA9EBD54B64” . Set Bx = 
(B g j\\H k (B g j\\g\\ID stego _ irnage \\y g8 ))(x) = (A1A2A3A4D08932564F74499D4 
EC45CA9EBD54B64)(a;). Let the generator polynomial G{x) = 100110001(a;)= 
a: 8 + x 5 + x 4 + 1. The CRC code is then generated as C g = R(x) = 
B(x)modG(x ) = (c s i,Cg2,-‘‘ , c g8 ) = ”00110000”. Then store C g into B g j 
of the stego-image. In the request of detecting the stego-image, pick up the 
embedded C r and Let T = Cr = ”00110000” and reset C g = ”00000000.” 
Run the CRC-based detecting authentication procedure again to obtain 
R(x) = (00110000) (a;). Compare if T is equal to the coefficient of R(x) as 
”00110000.” Clearly, in this case, they are consistent with each other. In a 
word, the block B g j of the stego-image remains the safe one from the mali- 
cious attacks. 
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15.4.3 Main Algorithms 

In this subsection, Wang et al.’s main algorithm, Secret Embedding and De- 
tecting Algorithm (SEDA for short) and Target Secret Image Recovery Al- 
gorithm (TSIRA) are presented. More notations are given together with the 
above-mentioned notations as follows. 

Notations: 

If The jth cover image with the size 2 m x 2m pixels. 

Ij The jtli stego-image with the size of 2m x 2m. 

Bg d j The dth pixel value of the gth block B g j in the jth cover image. 

The dth pixel value of the gth block B g ^ in the jth stego-image. 

K: A secret key K used in the hash function. 

Secret Embedding and Detecting Algorithm: The SEDA aims at 
the secret embedding and detecting authentication. 

Input: S, Ij, j = 1, 2, • • • , n, k. 

Output: Ij, j = 1, 2, • • • , n. 

Step 1. Get the distinct feature-value fj = {x\\, x\ 2 , £13, £14, £21, £22, X 23 , £24) 
from B g j of the cover image Ij, where j = 1, 2, • • • , n. If j) is equal to one 
of the feature- values fi, f 2 ,- ■ ■ > fj- 1 , then keep looking for the next pair of 
pixels in block B g j. 

Step 2. Call RAHA to compute PV jy 9) = q g (fi) and let each PVp / 91 be 
the bit-string format as (y gl , y g2 , * * * , y g8 )- 

Step 3. Apply IPLA to generate a pattern-string. Inspecting each block 
B g j , set the bit string of (y r i, y r 2 , ■ ■ • ,y r &) to be the input of IPLA, 

r 2 1 

for g = 1,2, ■■■ , Zj- . The output of IPLA, a fc-bit pattern-string of 
(pi,P 2 , ■ ■ * , Pm 2 ) is then generated after blocks B' s are given. 

t i y ij 

Step 4. According to CRC-based detecting authentication procedure, 
ate authentication codes of (c g i,c g2 ), • • • , c' g8 s , for g = 1, 2, • • • , 

~ r 2 ~i 

Step 5. Arrange all pixels in block B g j , for g = 1, 2, • • • , , as the fol- 

lowing rule: 

^ g ,j (*^11? 5 *^165 Vgl 5 Cgl'), 

B g j = ( x 21 , - ■ ■ ,X26,y g 2,C g 2), 

Bg,j = ( X 31,’ •• ,X 3 6 ,y g 3 ,C g3 ), 

^ g,j (*^41 5***5 *^46 5 y<?4 5 ^54) 5 
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FIGURE 15.5 

A secret sharing system with target secret embedding of high capacity and 
detection authentication: (a) Flowchart of target secret embedding procedures; 
(b) Recovery of target secret forms the stego-images in our secret sharing 
systems. 


Bg d = (x 51 ,--- 

BgJ = (*61) ' • • 

B 7 gd = (* 7 i, ■ ■ ■ 

Bg,j = (*81,'" 


j *56) 2/g5) Cg 5)) 
) * 66 ) UgGi Cgs) 7 
) *76) y g 7 7 ^g7) ) 
) *86) Vg8i Cgs) 7 


Step 6. Construct Ij by gaining 


blocks B g j in order, g = 


Target Secret Image Recovery Algorithm: The TSIRA aims at the 
recovery of the original secret image. 


Input: A set of at least t stego-images and a secret key K. 


Output: A target secret image S if all the stego-images are authenticated to 
be genuine. 

Step 1. Renumber t of the inputted stego-images as Ij , j = 1,2, ••• ,t, in 
order. 
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Step 2. Use a secret key K and call the CRC-basecl detecting authentication 
procedure in the stego-image Ij. If the comparison for the authentication 
code C g is then correct, proceed to the next step, otherwise, a fake stego- 
image is detected. 

Step 3. For each PV jj'p and block B g j, apply IPLA to compute 
the pattern-string (pi,P2>’’ - , P m ? ) in the IPLA. Follow the sign of 

t 

Pi,P 2 , • ■ ■ , P m * to recover the bit-string of (y g i, y g 2, • • • , y g s) of in the B gg , 

t ’ 

for <7=1,2, ••• ,[=£ . 

Step 4. Pick up fj and calculate PV ■y'- 1 ' 1 in B g j, j = 1,2, ••• ,t. Follow 
RAHA to recover the polynomial with the t pairs of ( fj,PV-y^)'s , j = 
1 , 2 , •••,*. 

Step 5. Call RAHA to recover the polynomial with the t pair of 
(fj,PVjy^)'s, j = 1,2,-- ■ ,f. Obtain secrets Si,i = (g — 1 )t + l,(g — 
1 )t + 2, ■ • • , (<7 — l)t + (t — 1). 

Step 6. Combine all Si in order to reveal the target secret image S. 

Wang et al.’s scheme with the proposed algorithms to fulfill the sharing 
system with the target secret high capacity and detection authentication are 
sketched as shown in Figure 15.5. 


15.5 Experimental Results 

Capacity and detecting authentication procedure are presented and discussed 
in this section via the observations of experiments for benchmark images. 
Two samples of (2, 4)-threshold and (4, 6)-threshold schemes are taken into 
consideration, in order to highlight the contributions made by Wang et al.’s 
proposed method. 

15.5.1 Fidelity Analysis 

The target secret image is shown as Figure 15.6 (a). The benchmarks of the 
cover images are Bridge, Butterfly, Toys, and Airplane, respectively, shown in 
Figures 15.6 ( b ) — (e). The size of the target secret image is | of each cover 
image mentioned above. The corresponding four stego-images are shown in 
Figures 15.6 ( b ') — (e') after SEDA, where the cover images still look the same 
as the stego-images to the human eye. The measurements of peak signal noise 
ratio (PSNR) to discriminate between cover images in Figures 15.6 (6) — (e) and 
stego-images in Figures 15.6 (b') — ( e ') were evaluated as 43.42, 43.43, 43.41, 
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and 43.44, respectively. The target secret image, shown in Figure 15.6 (a) could 
be revealed when the (2, 4)-threshold was applied, via the four stego-images 
shown in Figures 15.6 (b')-(e'). The experiments to embed Figure 15.6 (a) and 
the resulting PSNR are summarized in Table 1. In addition, the revelation 
of the target secret image was the same as Figure 15.6(a) when the (2,4)- 
threshold was applied in the stego-images, as shown in Figure 15.6(b')-(e') 
and offered in Wang et al.’s scheme. It can be seen that significantly improved 
fidelity was achieved in Wang et al.’s scheme with the higher PSNRs, when 
compared to other studies [4, 12]. 

Now considering another case, the (4, 6)-threshold scheme is used to embed 
two target secret images, as shown in Figure 15.7 (a) and ( b ). The six cover 
images are shown in Figure 15.7 (c) — (h). The size of each target secret 
image is \ of each cover image. After SEDA, the corresponding six stego- 
images can be seen in Figure 15.7 (c')-(h'). The PSNR measurements for the 
discriminations between the six cover images in Figure 15.7 (c)-(h) and stego- 
images in Figure 15.7 (c')-(h') were evaluated as 43.39, 43.43, 43.42, 43.39, 
42.95 and 43.05, respectively, as shown in Table 2. Accordingly, the quality of 
the stego-image was visually acceptable, when compared to the corresponding 
cover images upon the high PSNRs. On the other hand, the target secret 
images, shown in Figures 15.7 (a) and ( b ) could also be exactly revealed when 
the (4, 6)-threshold was applied, via the six stego-images shown in Figures 
15.7 (c')-(h'). 

As seen below, colored benchmark images are further considered to the 
embedding system via SEDA. The target secret image is shown in Figure 15.8 
(a). These show the experimental results, using full color cover images. The 
PSNR measurements were evaluated as 43.39, 43.12, 43.41, and 43.40, respec- 
tively, for the discriminations between the cover and stego-images, shown in 
Figures 15.8 (b)-(e) and (b')-(e'). The comparisons, between the PSNR mea- 
surements in Wang et al.’s and some other studies are presented in Table 15.3. 
The (2, 4)-threshold scheme was applied, in this case, among the stego-images 
shown in Figures 15.8 (b')-(e'). The target secret image can be seen to be 
totally revealed, and identical to the original, shown in Figure 15.8(a). 


TABLE 15.1 

PSNR comparisons for past schemes and our scheme. 



Bridge 

Butterfly 

Toys 

Airplane 

Lin-Tsai-scheme (PSNR) 

39.11 

39.13 

39.2.3 

39.16 

Yang et al. scheme (PSNR) 

41.61 

41.46 

41.44 

41.69 

Wang et al. scheme (PSNR) 

43.42 

43.43 

43.41 

43.44 


15.5.2 Evaluating Authentication 

In this section, the detection ability of the Lin-Tsai scheme, Yang et al.’s 
scheme and Wang et al.’s are discussed. These are then compared, as shown 
in Figures 15.9-15.11. 
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TABLE 15.2 

PSNR measurements when embedding the two target secret 
images in Figure 15.5 (a) and (6) comparisons for past 
schemes and our scheme. 


Ball 

House 

Bridge 

Butterfly 

Toys 

Airplane 

PSNR 43.39 

43.43 

43.2 

43.39 

42.95 

43.05 


TABLE 15.3 

PSNR comparisons with the Lin-Tsai scheme. 



Milk 

Tiffany 

Baboon 

Airplane 

Lin-Tsai-scheme 

39.07 

39.08 

39.08 

39.07 

Wang et al. scheme 

43.39 

43.12 

43.41 

43.40 



(O (<0 (O 


FIGURE 15.8 

(a) the target images; (b)-(e) the four cover images; (b')-(e') the four stego- 
images. 



(a) {») (c) 


FIGURE 15.9 

Minor bit adjustments in the stego-image of ” airplane .” (a) Lin-Tsai scheme, 
(b) Yang et al. scheme, and (c) our scheme. 
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FIGURE 15.10 

Partial area adjustments in the stego-images of ” sailboat .” (a) Lin-Tsai 
scheme, (b) Yang et al.’s scheme, and (c) our scheme. 



to to to 


FIGURE 15.11 

Replacement of ” airplane” stego-image with ” pepper.” (a) original stego- 
image of ” Airplane” , (b) replaced by ’’pepper” Lin-Tsai scheme, (c) replaced 
by ’’pepper” in Yang et al.’s scheme, and (c) detected in our scheme. 


Case I. Minor bit adjustments in the stego-images, with results compared in 
Figure 15.9. 

Case II. Partial area adjustment of a fake stego-image that can succeed the 
fake scenarios in [4, 12], but this case is blocked in Wang et al.’s scheme, as 
shown in Figure 15.10. 

Case III. Replacement of a fake stego-image that was visually imperceptible 
was detected in Wang et al.’s , shown in Figure 15.11. As observed in Figures 
15.9-15.11, the three cases not detected by the schemes in [4, 12] were easily 
made out when Wang et al.’s was applied. The probability of passing a fake 
stego-image, in the scheme of Yang et al. [12], was (l) m , where one bit 

parity-check and hash were applied in a block (4-pixel) and = m 2 non- 

overlapping blocks were set in the stego-image. On the other hand, in Wang 
et al.’s, a block had an 8-pixel format, such that the probability of this block 
succeeding was (|) 8 while the probability of a fake stego-image succeeding in 
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2 2 ^ 

Wang et al.’s method-2 was ((|) 8 ) = (|) 4m ” only, where there were=^ = 

2 

blocks in total in the stego-image.The summary comparisons are shown 
in Table 15.4. 


TABLE 15.4 

PSNR comparisons with the Lin-Tsai scheme. 



High 

capacity 

Techniques used 
in authentications 

Probability of cheating 
(Numerical analysis) 

Thien-Lin scheme [8] 

YES 

N/A 

N/A 

Lin-Tsai scheme [4] 

N/A 

Parity bit check 

N/A 

Yang et al. scheme [12] 

N/A 

Hash Function 

(l/2) m2 

Wang et al. scheme [10] 

YES 

CRC and Hash fuction 

(l/2) 4 m 2 


15.6 Conclusions 

In this chapter, we introduce some polynomial-based image sharing schemes 
as well as our proposed scheme. These image sharing schemes are based on 
the (t, n) -threshold scheme to share the secret image to n participants. Some- 
times, some authentication approaches and steganographic approaches were 
applied. Algorithms, such as IPLA, RAHA, SEDA, and TSIRA, were incor- 
porated into our scheme; the RAHA and IPLA were applied [8, 11], aiming 
to guarantee higher capacity, and SEDA and TSIRA were used to enable the 
robust authentication requirement, to reveal the original target secret image. 
Compared to some other studies [4, 8, 12], Wang et al.’s scheme behaved bet- 
ter in the terms of capacity with secret embedding in a stego-image and in 
detection/authentication to block offers of fake shares. 
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16.1 Introduction 

More and more data are being transmitted via the public access network, the 
Internet, due to its favorable characteristics such as low cost, speed, and reli- 
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ability. Although the Internet is a public access network, certain data require 
secrecy, such as commercial or military images, to protect them from illegiti- 
mate users during transmission. Steganography is a technique for transmitting 
secret data without being noticed. This technique hides secret messages into 
cover media to avoid malicious attacks. The cover media can be digital images, 
digital videos, source codes, or even HyperText Markup Language (HTML) 
codes. The digital image used to embed the secret data is called a cover im- 
age, which becomes a stego-image once the secret data are embedded. With 
steganography, malicious attackers do not know that a stego-image carries se- 
cret data. Therefore, they will not try to extract the data or otherwise trespass 
on it. However, there is a weakness common to all steganographic techniques. 
If one of the stego-media is lost or corrupted, the secret data cannot be re- 
vealed exactly and completely. Therefore, several secret sharing techniques 
have been proposed to overcome this weakness. With regard to the concept of 
secret sharing, the well-known (k, n^-thresholcl schemes pioneered by Shamir 
[20] and Blakley [2], respectively, have four characteristics in common: 


(1) k < n. 

(2) The secret is shared among n participants. 

(3) Only k or more participants can reconstruct the original secret. 

(4) When the number of participants is (k — 1) or less, they cannot 
recover the original secret. 


Based on the ( k, n ^-threshold schemes, in 1995 Naor and Shamir [17] devel- 
oped the first secret image sharing technique to safeguard and share image- 
based secrets. Their approach, called visual secret sharing (VSS), makes it 
possible to publicly transmit secret images efficiently and safely. The detailed 
principles of such a technique follow: 


(1) The secret image is divided into n noise-like images, called shadows 
or shares, with each noise-like shadow containing no original image 
information. 

(2) n noise-like shares can be transmitted to n participants via the In- 
ternet instead of the secret image itself, so that each participant 
keeps only one single share. Thereby, VSS can prevent attackers 
from gaining access to the secret image directly. 
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(3) When any k or more shadows are brought together co-operatively, 
the secret image can be restored without any computations based 
on the properties of the human visual system. 


Following this pioneering research, many VSS schemes have been proposed 
over the past decade. Shamir’s polynomial-based secret sharing approach was 
adopted into secret image sharing by Thien and Lin in 2002 [23] . Then, Wang 
and Su [25] made some improvements to decrease the size of the shared images 
based on Thien and Lin’s scheme [23]. Studies in secret image sharing have 
focused on different active topics: decreasing share size [4,5,25], dealing with 
attacks by malicious users, and detecting fake shadows [14,18,29]. The research 
domain has been also extended from gray images to color images [1,3,4,6,7,21]. 
And, the generated shares become meaningful instead of noise-like from the 
start [24]. Aside from these issues, Yang [27], Cimato et al. [8], and Wang et 
al. [26] separately proposed a new VSS scheme, called a ProbVSS scheme, to 
deal with problems such as pixel expansion and computational complexity that 
typically arise in image sharing. The ProbVSS scheme is based on probabilistic 
concepts and is designed solely for binary images. By taking advantage of 
Boolean operations, this scheme overcomes the shortcomings inherent in high 
computational complexity and large pixel expansion at the same time. 

In 2004, Lin and Tsai proposed another kind of secret sharing scheme in- 
corporating both steganography and authentication [15]. In Lin-Tsai’s scheme, 
the secret image is divided into shadows and data hiding is used to embed the 
shares and corresponding authentication codes into the cover image. During 
the reconstruction and verifying phase, the hidden authentication codes are 
then extracted to verify the integrity of the stego-image. However, the size 
of the cover image becomes fourfold that of the secret image. The Lin-Tsai 
scheme combines steganography and authentication features to avoid trans- 
mitting an erroneous stego-image or intentionally providing a false image by 
using a parity check bit. However, by the principle of the parity check itself, 
the authentication ability is weak. 

Yang et al. proposed a new scheme to overcome some of the weaknesses in 
the Lin-Tsai scheme in 2007 [28]. Their objective was to prevent cheating by 
participants. They also improved the authentication ability and the quality 
of the reconstructed grayscale secret image. Although the Yang et al. scheme 
can restore a distortion-free secret image, it allows for a significant probabil- 
ity that a fake stego-image can be authenticated successfully, and the cover 
image size is still four times that of the original secret image. Building on 
their predecessors’ experience, in 2008 Chang et al. proposed a secret shar- 
ing scheme that incorporates authentication based on the Chinese Remainder 
Theorem (CRT) [9]. They successfully improved authentication capability by 
combining CRT. However, in Chang et al.’s scheme, pixel expansion remains 
a problem and the size of the cover image should be at least twice that of the 


© 2012 by Taylor & Francis Group, LLC 



428 Visual Cryptography and Secret Image Sharing 

secret image. In addition, generating authentication bits with CRT increased 
computational complexity. 

This chapter proposes an enhanced scheme with the aim of maintaining 
the effective authentication but eliminating the pixel expansion problem while 
retaining an acceptable computational cost. Our scheme uses two techniques in 
combination to reduce cover image size. The first is an error diffusion technique 
[13,22] that helps to transform a grayscale image into a binary image. The 
second, called ELUT, is an edge lookup inverse halftoning technique that relies 
on edge detection and a lookup table to generate a reconstructed grayscale 
image from a halftone image [11]. Inverse halftoning is a kind of commonly 
used technique to reconstruct grayscale images from halftone images. In 2005, 
a new edge-based lookup table scheme for inverse halftoning was proposed 
by Chung and Wu [11], by which, the quality of the reconstructed grayscale 
images was improved. In this chapter we call Chung and Wu’s scheme ELUT 
for short. 

Experimental results confirm that no pixel expansion occurs in the pro- 
posed scheme and the visual quality of the stego-image carrying the shadows 
is much better. Moreover, the proposed scheme successfully reduces compu- 
tational complexity while maintaining an acceptable authentication ability, 
which is much better than the performance of either Lin-Tsai’s scheme [15] or 
Yang et al.’s scheme [28]. 

The rest of this chapter is organized as follows. In Section 16.2, we briefly 
introduce the Lin-Tsai scheme [15], the Yang et al. scheme [28], and the Chang 
et al. scheme [9]. In Section 16.3, we briefly review the techniques adopted 
in the proposed scheme. Full details of our proposed scheme are explained 
in Section 16.4. Section 16.5 gives some experimental results. Finally, our 
conclusions are presented in Section 16.6 


16.2 Related Work 

In this section three existing schemes, the Lin-Tsai scheme [15], Yang et al.’s 
scheme [28] and Chang et al.’s scheme [9] are introduced, in turn. 

16.2.1 Lin and Tsai’s Scheme 

Lin-Tsai’s scheme is a (fc,n)-threshold polynomial-based scheme that combines 
steganography and authentication to enable the sharing of secret images [15]. 
Their scheme uses parity check to achieve authentication, and each pixel in a 
secret image is used to produce n shared pixels for n participants by using 
the polynomial function in Equation 16.1. 

F(x ) = (cq + c\X + ... + Ck-iX fe ^ 1 ) mod p. (16.1) 
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Later, both the parity check bits and the shared pixels are embedded into 
the corresponding four-pixel blocks in the cover image. For simplicity, assume 
that Iij is the ij-th pixel in the secret image and Bl, Bfj , £?"■ are the n 
cover blocks in the cover image, where is the block with position (i, j ) 
in the fc-th cover for 1 < k < n, which contains four pixels, Y^, V-, W-, and 
Z^j, as shown in Figure 16.1. 


Y-.k 

y 

y?y6y5y4ysy2yiyo 

V-k 

V 

V 7 V 6 V 5 V 4 V s V 2 VjV 0 

W k 

V 

w 7 w 6 w 5 w 4 W 3 W 2 W; W 0 

Z-k 

A? 

Z 7 Z 6 Z 5 Z 4 Z 3 Z 2 Z 1 Z 0 


FIGURE 16.1 

The ij - th block of the fc-th cover. 


Here, the binary representations of the pixels Y k ., V£j, and Z^, are ( yi 
V 2 ■ ■■Vs ), (I'l V2 ■■■Vs), (w 1 W2---WS ) and (21 Z2-..z 8 ), respectively. The steps 
in this scheme are as follows. 

Step 1: Set the modulus p used in the polynomial in 16.1 to 251. If the pixel 
Iij > 250, it is directly truncated to 250. Apparently, this operation 
can distort the secret image. 

Step 2: Take the pixel I %3 as the coefficient cq and choose k — 1 inte- 
gers as other coefficients c\, C 2 , Ck-i randomly to construct a 
polynomial in Equation 16.1. Then takes the pixel value Y-% for 
1 < k < n as the input x of the polynomial to compute the shared 
pixel F (Yjj) = = (si s 2 ...s 8 ), where (si s 2 ...s 8 ) means eight bits 

of the shared pixel . 

Step 3: Embed the shared pixel 6* into the block by replacing the eight 
bits Vj v 8 , wq w 7 w$ and ze z 7 z 8 with si s 2 ...s 8 as shown in Figure 
16.2. 
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Step 4: Generate a check bit b according to parity check policy to achieve 
the authentication capability shown in Figure 16.2. 


Y k 

v 

yiy&sytfsyiyiyo 


w 


w 7 w 6 w 3 w 4 w 3 ^ 1 s^s ± 


VI 

v 7 v 6 v 5 v 4 v 3 | bsjs 2 


Z 7 Z 4 > Z 3 Z 4 Z 3 


6 * 7*3 


FIGURE 16.2 

The block of the fc-th stego-image in Lin-Tsai’s scheme. 


Unfortunately, in Lin-Tsai’s scheme, the parity bit of the upper-right pixel 
shown in Figure 16.2 is chosen to make this pixel an even or odd parity as 
a binary parity sequence. Dishonest participants can derive the parity in- 
formation from their own stego-images, and thus can easily and maliciously 
counterfeit a stego-image. For instance, assume that the upper-right pixel V-% 
= (11011 111). A dishonest participant can modify it to (11011 010), which 
still meets the odd parity, but the 8-bit input of (fc-l)-degree polynomial be- 
comes changed. Thus, it successfully passes authentication but the (fc-l)-degree 
polynomial cannot be obtained. In addition, the dishonest participant can also 
modify three other pixels, Y^, Wh , and Z^, to change the input and output 
of (fc-l)-degree polynomial without influencing the upper-right pixel V i3 , thus 
passing authentication. Therefore, their scheme has a weak authentication 
process, which may allow a fake stego-image to pass the authentication check 
quite easily. 

16.2.2 Yang et al.’s Scheme 

To overcome the weaknesses in Lin-Tsai’s scheme, Yang et al. [28] proposed 
an improved version in 2007. In Yang et al.’s scheme, the modulus value p is 
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set to the Galois Field GF(2 8 ), that is, p = g(x) = x 8 + x 4 + x 3 + x 1 + x°. 
This approach allows the acquisition of a secret image without distortion. 
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UrU 6 U 5 U 4 U 3 U 2 Uj u 0 


FIGURE 16.3 

The cover blocks used in Yang et al.’s scheme. 
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FIGURE 16.4 

The block of a stego-image in Yang et al.’s scheme. 


In Yang et al’s scheme, let the pixel of the secret image be used to 
produce the n shared pixels Sh , to be embedded into the cover 

blocks where each cover block is represented as C- = {V,^, 

Yjj, Zh , XJfj } for 1 < k < n as shown in Figure 16.3. Pixel of the secret 
image is first embedded into the coefficient Cq to construct a polynomial as 
shown in Equation 16.1. Next, the shared pixel S fj is computed by taking the 
pixel value Vh of the corresponding cover image block C* as the input x of 
the polynomial shown in Equation 16.1. Let the binary representation of the 
shared pixel S 3 j be (si S 2 ...s§). Hence, the shared pixel Sh is embedded into 
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its corresponding cover image block C% by replacing the eight bits v\ vq yi 
2/o Z\ Zq ui «o with Si s 2 . ..ss, and at the same time, the bits z 3 z-i of pixel 
Zh are replaced by v\Vo of pixel Vi in order to keep the complete pixel value 
for recovering the corresponding secret pixel as shown in Figure 16.4. 
However, Yang et al.’s scheme cannot avoid the fact that four least sig- 
nificant bits (LSBs) of the pixel value Z\ ;j in each block must be modified. 
Such modification may make the stego-images different from the cover images 
visually and the risk of being observed by attackers is increased. 

To further improve Lin-Tsai’s authentication ability, Yang et al. used the 
hash-based message authentication code (HMAC) in Equation 16.2. 

H k ((C^-b)\\id), (16.2) 


where id is the block ID; C,k is 31 bits except the check bit b; H( ) and k denote 
a one-way hash function and the secret key, respectively. Next, as shown in 
Equation 16.3, the 160-bit HMAC output and executes the XOR operation to 
obtain the authentication bit b. 

b=H k ((C? j -b)\\id ) (16.3) 

However, the average probability of detecting any malicious modification is 
just 50% because of the characteristic of the parity check itself. In other words, 
the fake stego-images still have a very high probability of being authenticated 
successfully. 

16.2.3 Chang et al.’s Scheme 

In 2008, Chang et al. proposed an enhanced secret sharing scheme based on 
Lin-Tsai’s scheme and Yang et al.’s scheme. They used the concept of Thien 
and Lin’s secret image sharing [23] to ensure that no distortion is introduced 
into the secret image and applied the concept of the Chinese Remainder The- 
orem (CRT) to improve authentication ability. As a result, their scheme can 
achieve high authentication ability. The flowchart of Chang et al. ’s scheme [9] 
is shown in Figure 16.5. 

Four check bits p\, P2, p 3 , Pa can be calculated and embedded into the 
stego-block (shown in Figure 16.5). The details are shown in the steps below. 

Step 1: The residues set of the block in Figure 16.6 is determined. 
Rij t l=(x7XeX 5 XAX 3 SiS2)-, 

R'i:j,2=( v 7VeV 5 V4S 3 S4)-, 

Rij^=(w 7 WeW 5 W4W3S 5 S 6 y, 

Ri jA = ( z 7Z6 z 5Z4Z 3 S 7 S S ); 

Rij, 5 = *i 
R%, 6= 3- 
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FIGURE 16.5 

The block of a stego-image in Chang et al.’s scheme. 


Step 2: Decide six moduli that are pairwise relatively prime M- ^ , M^ 2 > 
and Af* 6 , where each modulusM^ 0 , for 1 < a < 6 , is the 
prime number greater than R!-^ a . 

Step 3: Calculate the Y k integer by Equation 16.4. Suppose that the binary 
representation of the Y k - is (j/i2/2---2/ e )- Note that the number of 
binary bits of Y k has to be a multiple of 4. 

Y = d2 R * x w xIi) (16 - 4) 

Step 4: Four interim authentication bits a\, 02, 03, and 04 are computed by 
Equation 16.5. 

aia 2 a 3 a 4 = (1/12/22/32/4)® (2/52/62/72/8)©---ffi (i/e-32/e-2?/e-i2/e)- (16.5) 

Step 5: Denote 61, & 2 ,& 3 , and 64 as the current four watermark bits; four 
check bits pi, p 2 , p 3 , and p 4 can be computed by Equation 16.6. 

P 1 P 2 P 3 P 4 = (ciia 2 a 3 a 4 ) ® (&i5 2 6 3 6 4 ). (16.6) 

Step 6: Replace the four LSBs XqVqWqZq with the computed check bits p\ 
P 2 P 3 Pa as presented in Figure 16.6. 
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FIGURE 16.6 

The flowchart of Chang et al.’s scheme. 


16.3 Adopted Techniques in the Proposed Scheme 

To give sufficient background knowledge, this section briefly introduces the 
related techniques adopted in our proposed scheme, including error diffusion, 
interpolation, canny edge detector, and edge lookup inverse halftoning as well 
as the Shamir scheme for secret sharing, respectively. 


16.3.1 Error Diffusion Technique 

The error diffusion technique is typically used to convert a multiple-level color 
image into a two-level color image. There are many kinds of idiographic error 
diffusion strategies. The common concept behind diffusion is the diffusion 
of errors to neighboring pixels; in this way, no image luminance is lost. The 
diffused image generated based on an error diffusion strategy is called an error 
filter. Each error filter has a set of kernel weights. Assume that GI(x,y) is the 
value of a pixel in position (x,y) in a grayscale secret image. Figure 16.7 is a 
flowchart of the error diffusion technique. 

In the proposed scheme, the Floyd and Steinberg error diffusion strategy is 
adopted and the kernel weights are Wr = Wb = j^,Wbl = jq , Wbr = ^ 
as shown in Figure 16.8. 

After the quantization procedure, a pixel GI(x,y) at position (x,y) in 
grayscale image GI becomes HI(x,y) and has a value of either 0 or 255. Dur- 
ing the quantization procedure, a threshold TH is used to determine HI(x,y) 
according to Equation 16.7 and the quantization error is determined by Equa- 
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FIGURE 16.7 

Error diffusion architecture. 



FIGURE 16.8 

The kernel weights of Floyd and Steinberg’s error filter. 


tion (5.8). 


HI(x,y) 


255, ifGI(x, y) >TH 
0 , otherwise 


(16.7) 


E(x,y) = GI(x,y) - HI(x,y) (16.8) 

Next, error E(x,y) is diffused over four neighboring pixels, GI(x, y+1 ), GI (x+1, 
y-1), GI (x+1, y), and GI(x+l, y+1 ), according to Equation 16.9 and the kernel 
weights (denoted as W) of the error filter are shown in Figure 16.8. 

GI(x + i,y + j) = GI(x, y) + E(x,y) x W, (16.9) 

where i,j G {0, 1}, W G {^, 

Based on Figure 16.8 and Equation 16.9, we can see that when pixels are 
on the border of the grayscale image, special cases occur. The four kinds of 
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pixels listed below should be considered in distinguishing these cases. 

Case 1: The pixels located at (x, 1), where x = 1, 2,..., H- 1. 

Case 2: The pixels located at (H, y), where y = 1, 2,... , W-l. 

Case 3: The pixels located at (x, W ), where x = 1, 2,..., H-l. 

Case 4: The pixel located at ( H , W). 

The positions of all four kinds of pixels are represented in Figure 16.9, with 
the white squares showing the positions of the pixels located at the border 
of an image. To deal with these special cases, we adopt a special skill, called 
’’excursion” in the procedure, as shown in Figure 16.10. 
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FIGURE 16.9 

The positions of pixels located at the border in an image. 


When applied to these pixels, Floyd and Steinberg’s error filter is slightly 
modified to ignore the nonexistent pixels because the number of these pixels is 
small compared with the total number of pixels in the whole image. To give a 
clearer explanation, the following paragraphs give one instance for each case. 

At first, set E(l, 1) = 0. For case 1, the pixels at position (x, 1), where x = 
1, 2,..., H-l are considered. We take the pixel at position (1, 1) for example. 
The value of HI(1, 1) is determined by Equation 16.7. However, there is no 
pixel at position (2, 0) corresponding to GI(x+l, y- 1). Thus, the neighboring 
pixels that accepted error diffusion are shown in Figure 16.11 for Case 1. 

For Case 2, we take the pixel at position ( H , 1) for example. The pixel at 
position (H, 1) is called GI (H, 1) and has an error value of E (H, 1). However, 
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1 2 3 4 5 6 7 8 


w m W+2 



FIGURE 16.10 

The ’’excursion” skill. 


there are no pixels at positions (H+l, 0), (H+ 1, 1), and (H+ 1, 2) correspond- 
ing to GI(a;+l, y- 1), GI(x+l, y), and GI(aH-l, y+ 1). Thus, the neighboring 
pixels that accepted error diffusion are shown in Figure 16.12 for Case 2. 

For Case 3, we take the pixel at position (1, W) for example. There are no 
pixels at positions (1, W+l) and (2, W+l) corresponding to GI(x, y+ 1) and 
GI(:r-|-l, y+ 1). Thus, the neighboring pixels that accepted error diffusion are 
shown in Figure 16.13 for Case 3. 

And last, for Case 4, the pixel Gl(H, W) at position ( H , W), there are 
no pixels at positions (H, W+l), (H+l, W-l), (H+l, W ), and (H+l, W+l) 
corresponding to GI(x, y+1), GI(a;-|-l, y-1), GI(x-|-l, y), and GI(a:+l, y+ 1). 
Thus, there are no neighboring pixels that accepted error diffusion for this 
case. 

We next describe how to use the Floyd and Steinberg error diffusion strat- 
egy to transform a gray-scale image into a binary image. The detailed steps 
are set forth as follows: 

Input: A gray-scale secret image GI sized H x W . 

Output: A binary image HI sized H x W. 

Step 1: Set a threshold TH = 127 
Step 2: for i=l H, j= 1: W 
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FIGURE 16.11 

The neighboring pixels that accepted error diffusion for Case 1. 



FIGURE 16.12 

The neighboring pixels that accepted error diffusion for Case 2. 


Loop: if (* = 1) or i = H + 2 )| (j = 1) or (j= W+2)— » EGI(zj') = 0; 
else EGI(i,j) = GI(i — 1, j — 1); 


Step 3: for i = 2:H + 1, j= 2:W + 1 

Loop: if EGI(i,j) > TH ^EHI(ij) = 255; 
else EHI(*,j) = 0; 

E (i,j) = EGI(*j)-EHI(i,j); 

EGI(*,j + 1) = EGI(*j + 1) +E(i,j) x Wr, 

EGI(z + l,j) = EGI(*j + 1) +E(i,j) x Wb; 

EGI(i + 1 ,j + 1) = EGI(z + 1 ,j + 1) +E(i,j) x Wb ; 
EGI(z + 1 ,j - 1) = EGI(i + 1 ,j - 1) + E(i,j) x Wbl; 

Step 4: for i = 1: H, j = 1: W 

HI (i,j) = EHI(i +l,j+ 1). 
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FIGURE 16.13 

The neighboring pixels that accepted error diffusion for Case 3. 


16.3.2 Interpolation Technique 

In computer computations, a discrete number system rather than a real num- 
ber system is applied due to the limitations of machine representation. There- 
fore, a continuous signal must be sampled for computer storage and calcula- 
tion. However, sampling is always destructive to the original information and 
new samples often must be reselected when the sampling scale is changed. Let 
us denote R as a real signal performed in the real number system as shown 
in Figure 16.14(a); denote D as the digital signal created by R , which is per- 
formed in the discrete number system shown in Figure 16.14 (b). The digital 
signal D' shown in Figure 16.14(c) is generated by sampling digital signal D. 



FIGURE 16.14 

Example of sampling an image: (a) Real signal R; (b) Sampled signal D of R- 
(c) Sampled signal D’ of D. 


Figure 16.14 shows that the re-sampled signal D' can be easily retrieved 
when the real signal R is always available. However, the original signal is 
usually discarded after receiving the digital signal D. As a result, the resampled 
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signal D' must be created from the former signal D. Interpolation is a classical 
solution for calculating the new samples from another digital signal. Take 
bilinear interpolation for example. A new sample in signal D' is expected to 
be an average value of the two neighboring original samples in D. Assuming 
that {x, f(ir)) and ( y , f (y)) are two neighboring samples in D , we can calculate 
a new sample (z, f (z)) in U according to Equation 16.10. 

f{z) = - — - x f(x) + - — - x f(y). (16.10) 

y — x y — x 


16.3.3 Canny Edge Detector 

Edge detection is a kind of commonly used technique in image processing. 
The areas in an image with strong intensity contrasting from one pixel to the 
next are called edges. The purpose of edge detection is filtering out useless 
information in an image and significantly reducing the amount of data, while 
preserving the important structural properties. 

Since the pioneering work by Roberts in 1965 [19], a mass of schemes have 
been developed for detecting edges. The Canny edge detection algorithm is 
known to many as the optimal edge detector proposed by J. Canny in 1986 
[12], which finds edges by looking for local maxima of the gradient of the input 
image. The gradient is calculated using the derivative of a Gaussian filter. The 
Canny edge detector contains several adjustable parameters, listed as follows, 
which can affect the computation time and effectiveness of the algorithm itself. 
The first parameter is the size of the Gaussian filter, the smoothing filter used 
in the first stage, which directly affects the results of the Canny detection 
algorithm. Generally, smaller filters cause less blurring, and allow detection of 
small, sharp lines. On the contrary, larger filters cause more blurring, smearing 
out the value of a given pixel over a larger area of the image. Two thresholds 
are the other parameters. Actually, a too high threshold may make missing 
important information. On the other hand, a threshold set too low will falsely 
identify irrelevant information as important. Therewith, the detection would 
be more likely to be fooled by noise. The Canny edge detection method uses 
two thresholds, to detect strong and weak edges, and includes the weak edges 
in the output only if they are connected to strong edges. 

The Canny edge detector works in a multistage process. First of all, the 
image is smoothed by Gaussian convolution. Afterwards, to highlight regions 
of the image with high first spatial derivatives, a simple 2-D first derivative 
operator is applied to the smoothed image and edges give rise to ridges in the 
gradient magnitude image. Then, the algorithm tracks along the top of these 
ridges and sets to zero all pixels that are not actually on the ridge top so as 
to give a thin line in the output, a process known as nonmaximal suppression. 
The tracking process exhibits hysteresis controlled by two thresholds, denoted 
by Xj and T 2 , where Xj > X 2 . Tracking can only begin at a point on a ridge 
higher than T\ and then continues in both directions out from that point until 
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the height of the ridge falls below T 2 . The Canny edge detector is more likely 
to detect true weak edges and less likely than the others to be fooled by noise. 

16.3.4 Edge Lookup Inverse Halftoning Technique 

The inverse halftoning technique is used to reconstruct a gray-scale image from 
an input halftone image. Based on the lookup table (LUT) [10,16] technique, 
in 2005 Chung and Wu [11] proposed a new edge-based lookup table (LUT) 
scheme that improves the quality of the reconstructed grayscale image. In 
the following paragraphs we call Chung and Wu’s scheme ELUT for short. 
The ELUT scheme first applies the LUT-based inverse halftoning scheme as a 
preprocessing step to transform the input halftone image to a base grayscale 
image, and then the edges are extracted and classified from the base grayscale 
image. According to these classified edges, a novel edge-based LUT is built up 
to reconstruct the grayscale image, i.e., the ELUT scheme. Figure 16.15 is a 
flowchart of Chung and Wu’s ELUT scheme. 



FIGURE 16.15 

The flowchart of Chung and Wu’s ELUT scheme. 


Input: A set of n training image pairs (G/j, HIi), where GI* and R/,; are 
denoted as the i-th grayscale image and its corresponding halftone 
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image, respectively. 

Step 1: Generate the lookup table (LUT) by using the five substeps that 
follow. An array LUT[ ] is used to map the given halftone image to 
the corresponding grayscale image. 

(a) For initialization, i = 1, LUT[fc] = 0, where 0 < k < 2 16 — 1. 

(b) Divide images double Hli and G/,; into overlapping 4x4 
blocks and denote them as BH^ and BGij. In other words, 
BHij and BGij are the j-tli halftone block of halftone im- 
age Hli and the j-tli grayscale block of grayscale image 
Gli, respectively. 

(c) Calculate index k for each halftone block BHij and update 
the value of the intermediate LUT[fc] by using Equation 
16.10. Here, BGij (3, 3) is a representative pixel for each 
grayscale block. 

f k = Eti Eti 2 ( "- 1)+4x( “- 1) x BHij{u,v) 

\ LUT[K] = LUT[K] + BG^ 3, 3) 

(16.11) 

(d) i = i + 1. If i < n, go to Step b. Otherwise, compute and 
archive the final LUT [ ] . N [k] is another array used to store 
the number of halftone blocks that obtain the same index 
value k. 

(e) For 0 < k < 2 16 - 1, LUT[k] = 

Step 2: Replace the element BHij( 3,3) in every block BHij by LUT[fc], 
where k is the index value of block BHij calculated in Step c. When 
the replacement procedure is finished, retrieve the grayscale image 
with pixel values corresponding to LUT[fc]. 

Step 3: After applying Step 2 to a set of n training images in succession, 
a set of reconstructed grayscale images called GI[, i = 1, 2,..., n, 
can be retrieved. Adopt Canny’s edge detector to each reconstructed 
grayscale image GI[ to generate an edge map EMi , for i = 1, 2,..., n. 
Each edge map EMi consists of a set of 4 x 4 blocks. Therefore, the 
j-tli block of the edge map EMi is denoted as BEij. By combining 
the lookup table LUT generation procedure described in Step 1 with 
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a set of edge maps EMi , an edge-based LUT, called an ELUT, 
is generated. Note that in this step, we call the edge map EM. 
The order of the edge pattern of the 'ij-th block is denoted as BEij. 
The index value for ij- th block is 7,; ; for 0 < k < 2 16 — 1. Finally, the 
mean grayscale value can be derived from ELUT[/,j, BE, tJ \, where 
0 < EMjj < 38 based on the number of edge patterns reported 
by Chung and Wu [11]. In Chung and Wu’s scheme, the value of 
GIh( 3, 3) is determinate as Equation 16.12. 

GI'^ 3, 3) = ELUT[Iij, BEij] (16.12) 


Step 4: Input a halftone image HI, which will be converted to the grayscale 
image GI . The detailed procedure is shown in Figure 16.16. 



FIGURE 16.16 

Procedure for generating final grayscale image in Step 4. 


16.3.5 Shamir Scheme for Secret Sharing 

The proposed scheme for secret image sharing is based on the (fc,n)-threshold 
secret sharing scheme proposed by Shamir (1979) [20]. In this section we 
describe how to use the Shamir scheme to generate secret sharing. In the 
following steps we use the (fc-l)-degree polynomial shown in Equation 16.16 
to generate n shares for a group of n secret sharing participants from a secret 
integer value s for the threshold k. 


F(xi ) = s + ai x x} + a 2 x xf + ... + ak-i x x * 1 


(16.13) 


© 2012 by Taylor & Francis Group, LLC 











444 


Visual Cryptography and Secret Image Sharing 


where i = 1, 2 ,...,n. 


Step 1: Select the number fc, k < n. 

Step 2: Choose the (fc-1) integers aq, a 2 , ..., afc_i randomly. 

Step 3: For the i-th secret sharing participant, choose a value of x, freely, i 
= 1, 2,..., n. Note that all x, must be distinct from one another. 

Step 4: For each chosen x*, compute the corresponding F(xi) by using 
Equation 16.13. 

Step 5: Deliver each pair of (xj, F(x,;)) as a secret share to each participant. 


In this secret sharing process, the values of oq, *=1,2, ..., k — 1, need not be 
kept after all secret shares are generated. As well as the secret value s, each 
aq can be recovered from the n secret shares in the secret recovery steps listed 
below. 


Step 1: Collect at least k secret shares from the n ones to form a system of 
equations as shown in Equation 16.13. Note that the xi and F{xi) 
in Equation 16.13 with i =1, 2, ..., k can all be extracted from the 
k secret shares. 


Step 2: Use a polynomial interpolation technique, e.g., Lagrange scheme, to 
solve s and a,, i = 1, 2, ..., k — 1. Reconstruct the ( k — l)-degree 
polynomial F(x) described by Equation 16.14. 

77! / \ _ p, N 0 - X 2 )(x - X 3 )...(x - Xfc) 

Xl (xi - x 2 )(xi - x 3 )...(xi -Xfc) 

+ {x-Xi)(x-Xz )...(x-Xfc) 

; (x 2 - Xi)(x 2 - x 3 )...(x 2 - Xfc) (16.14) 


+ F(x k ) 


(x - Xi)(x - x 2 )...(x - Xfc-i) 
(Xfc - Xi)(Xfc - x 2 )...(x fc - Xfc_i) 


Step 3: Compute the solution for the secret value s by Equation 16.15. 
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+F(x k ) 

+^(£2) 

+... 

+F(x k ) 


(x- 

- X 2 )(x - 

- X 3 ).. 

■(x- 

Xk) 

(xx - 

x 2 )(xi 

- X 3 ).. 

..{xx 

- Xk) 

(0- 

- aq)(0 - 

- X 3 )... 

■(0- 

Xk) 

(x 2 - 

X'l)(x 2 

- X 3 )- 

■■{x 2 

- Xk) 

(0- 

- X]_)(0 - 

- X 2 )- 

.(0- 

Xk- 1 ) 

(xic - 

Xl)(x k 

- x 2 ). 

-{Xk 

- x k - 1 ) 

: ~ 1 \F 


X 2 X 3 

-Xk 


- x 2 ){xx - 

x 3 )...{xx 


X!X 3 ...Xk 



(X2 - 

X'l)(x 2 

- X 3 ).. 

■■(X2 

- Xk) 


XxX.2-.Xk 

-1 


(Xk - 

xx)(x k 

- x 2 ). 

..(xk 

•Xk— l) 


(16.15) 


16.4 Proposed Scheme 

Following on the details described in the previous discussions, this section 
presents a detailed and complete description of the proposed scheme. In our 
scheme, a halftone image HI is created from the grayscale secret image GI , 
sized H xW with 8 bits per pixel, by using an error diffusion technique called 
EDT. The transmitted stego-image is called SI and the reconstructed grayscale 
secret image is called GL . The proposed scheme includes two procedures: the 
first is the sharing and embedding phase, and the second is the reconstruction 
and verifying phase. General flowcharts of the phases of our scheme appear in 
Figure 16.17 and Figure 16.18. 

16.4.1 Sharing and Embedding Phase 

A detailed algorithm for the sharing and embedding phase is described in this 
section. 

Input: The secret grayscale image GI and cover image CI. 

Output: Stego-image SI. 

Step 1: Apply the error diffusion technique (EDT) to the grayscale im- 
age GI to retrieve a halftone image HI. Obviously, the width and 
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FIGURE 16.17 

The flowchart of the work by the sender. 



FIGURE 16.18 

The flowchart of the work by the recipient. 
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height of HI are W and H. Moreover, each pixel in halftone image 
HI contains only 1 bit. 


Step 2: Divide halftone image HI into Z nonoverlapping 6-bit blocks, 
Z = [ H j . HI Z ( z = 1,2 ,...,Z) is the z- th block of HI and the 
value of HI Z is denoted as P z illustrated in Figure 16.19. 



0 

10 

255 

EDT 

0 

0 

1 



25 

0 

200 


0 

0 

1 




z-th block of secret 
image GI 

corresponding block of __ 

HI called Hlz 


FIGURE 16.19 

The z-th block of GI and the corresponding HI Z1 P Z . 


Step 3: This is the basic process for secret image sharing with P z as the 
secret, z= 1, 2 ,..., Z, Z = [ H . This procedure contains five 
substeps, which are performed as follows. 

(a) Take the value X, formed from 2-MSBs (Most Significant 
Bits) of the four pixels of each cover CBi as the value x 
specified in Equation 16.16, *=1,2, ..., n, as shown in 
Figure 16.20, X % = ( c 7 c 6 d 7 d 6 g 7 g e h 7 h 6 ) D . 

F(xi) = (s + a i x xl + a 2 x x? + ... + a/c-i x a;^ -1 ) mod 2 6 

(16.16) 

(b) Take the secret P z as the value s specified in Equation 
16.16. 

(c) With a random number generator, generate a set of k — 1 
integers a i, 02 , ■■■, ak-i in Equation 16.16, where k < n. 

(d) For each X,, compute the corresponding value of F(X, ; ) by 
Equation 16.16 to form a secret share (X,. F ( X , ) ) for each 
participant in the secret sharing group, F(Xj) = /s f '4 

fi fi fo- 

(e) Hide the six data bits of F(W) in the Least Significant Bits 
of the four pixels C*, Di, Gi , and Hi of the corresponding 
cover block CBi as shown in Figure 16.21. 
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FIGURE 16.20 

The four pixels of each cover block CBi. 


Step 4: To prevent illicit attempts, a simple authentication ability is 
added here. Compute check bits pi by using Equation 16.17 and 
embed pi into the remaining LSBs of Ci, D it Gi, Hi from the 
same cover block CBi, where i = 1, 2, ..., t. Note that t is the 
total number of check bits, which is discretionary and could be 
decided by the sender according to authentication strength. For 
simplicity, we take t = 2 as an example to explain the procedure 
as shown in Figure 16.22. Figure 16.23 illustrates a flowchart of 


Ci 

C 7 C A C 1 C 4 C 1 C 2 fif 4 

Di 

d 7 d 6 d 5 d 4 d 3 d 2 fj ? 

Gi 

S'SeSySjSs S 2 Si fi 

Hi 

h 7 h 6 h 5 h 4 h } h 2 h 1 f 0 


FIGURE 16.21 

Hiding the six data bits of F(Xz). 


© 2012 by Taylor & Francis Group, LLC 


Image Sharing with Steganography and Authentication 


449 


this phase. 

T — C 7 C 6 C 5 C 4 C 3 C 2 / 5/4 || d’ldsd^d^d-sdif'ifi II 0756ff554ff332/i || / 17 / 16 / 15 / 14 / 13 / 12/0 
P = T mod 2* 

P= {Pi | i G {1,2, ...f}, ft G {0,1}} 

(16.17) 


Ci 

C 7 C 6 CjC 4 Cj c 2 f s f 4 

Di 

d 7 d 6 d s d 4 d 3 d 2 f 3 f 2 

Gi 

8 e S5 84 Si S:\~P2\f1 

Hi 

h 7 h 6 h 5 h 4 h 3 h[pj\f 0 


FIGURE 16.22 

Hiding the check bits p\ ,p 2 ■ 


16.4.2 Reconstruction and Verifying Phase 

This section describes the proposed secret recovery scheme and authentication 
scheme. Recall that after performing the secret sharing process for a group of 
n participants, each participant obtains one stego-image S/{. The proposed 
process for stego-image authentication and secret image recovery is summa- 
rized in the following paragraphs. 


Input: The random number generator used to generate integers 
ai, 02 , ..., (Xfc-i in Equation 16.16, the secret key t used for gen- 
erating the check bits (e.g., t = 2), and a set of at least k stego- 
images S'/}, say m ones, with k < m < n , j = 1, 2, ..., m. 

Output: A report of failure of secret reconstruction, or the recovered secret 
image GT if all the stego-images are authenticated as genuine. 

Step 1: Use the random number generator to generate ai,a 2 , ...,afc_ 1 in 
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FIGURE 16.23 

The flowchart of Step 4. 


Equation 16.16. 


Step 2: Divide each received stego-image 57'-, j = 1, 2,..., m, into 2x2 
blocks CB[, CB' 2 , CB' Z and denote the four pixels in each 
block CB Z as C z , D' z , G' z , and H z as shown in Figure 16.24. 

Step 3: For each stego-image 57' from participant j, j £ {1,2, , 

perform the following substeps for stego-image authentication. 


(a) t = 2, extract the 2-bit check bits from each block CB’ Z , as 
shown in Figure 16.25. P 2 = g’ lt P\ = h[. 

(b) Calculate the data for verification according to Equation 
16.18. 
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Cj 

c 7 ’c 6 'c 5 'c/c 3 ’c 2 ’Cj’c 0 ’ 

D'j 

d-'d 6 'd,'d/d;’d 2 'dj'd 0 ' 

G j 

g/Se'Ss'S/Ss'S/Sj'go' 

H’j 

h 7 ’h 6 ’h 5 'h 4 ’h 3 'h 2 'h 1 ’h 0 ' 


FIGURE 16.24 

The four pixels of each stego block CB'j. 


T = C'z II D’ || G’z - g\ || Hz’ - h\ 

P = T 1 mod 2 4 , (16.18) 

P’ = { V \ |ie{i,2,..i},p'e{0,i}} 


(c) If for each block, P 2 = p 2 , P[ = P\, then regard the stego- 
image as having passed authentication and continue; other- 
wise, decide that the stego-image has been tampered with. 


Cj 

c 7 ' C 6 C 5 C 4 C 3 C 2 C 1 C 0 

Dj 

d 7 dg dj dj d ; dj dj dg 

Cj 

S-'Se Si'S/Si'S:' 8i ?o 

Hj 

h 7 'h 6 'h 5 'h 4 'h, h/h/ h 0 ' 


FIGURE 16.25 

The 2-bit check bits carried in CB’z when t = 2. 
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C'i 

c 7 c 6 c 5 c 4 C 3 C 2 Cj c 0 

D'i 

dld 6 ’_d s d/d/d 2 dj'd 0 ' 

G'i 

g-‘ge 858483 'Si'Si So ' 

H'i 

h 7 ‘h 6 ’ h 5 h 4 'h 3 'h 2 'h 1 'h 0 ' 


Xi =c-’c e 'd-'d ( ’g-’g e 'h-’h 6 ' F(AT) ^c/Cg'd/dg'gg'hg) 


FIGURE 16.26 

The bits of X, and F(Xi) carried in the stego block. 


Step 4: If m! stego-images have passed authentication in Step 3, and 
m! > k , then continue. For each collected stego-image SI[, SI' 
= Sip, otherwise, stop the program and report failure of the se- 
cret recovery step. 

Step 5: For each 2 =1, 2, ..., Z, Z = [ H perform the following sub- 
steps to recover the secret data P z . 

(a) For each SI',i G {1,2, ...to'} , extract the 2 most significant 
bits (MSBs) of the four pixels of each cover as the value Xi 
specified in Equation 16.16, X = (c^Cgdydg^gg/iy/ig)^; ex- 
tract the data bits of F(A'j) from the LSBs of pixels C[, D\, 
G[, and H[, as shown in Figure 16.26, as a value of F(A*) 
appearing in Equation 16.16. 

(b) By using the scheme described in Section 16.3.5, compute 
the corresponding value of y as the value P z . 

(c) For each z = 1, 2, ..., Z, Z = [ H * w ], perform last steps to 
obtain all of the P z for the blocks of halftone image HI of 
the secret image GI. 

Step 6: Apply the edge- and LUT-based inverse halftoning algorithm 
(ELUT, introduced in Section 16.3.4) to the halftone image HI 
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to retrieve the gray-scale image G/, i.e., the secret image. 


16.5 Experimental Results 

The feasibility of the proposed scheme was confirmed by the experimental 
results discussed in this section. We conducted three experiments, one to esti- 
mate the visual quality of the stego-images; the second to estimate the visual 
quality of the reconstructed secret images; and the last to evaluate the ca- 
pability of identifying the tampered region. The test images shown in Figure 
16.27 are four grayscale images ” Jet-F'l 6” , ” Baboon” , ” Lena” , and ’’Pepped’. 

For our experiments, we chose the peak-signal-to-noise ratio (PSNR) as 
the criterion to measure the visual quality of the grayscale images, which is 
defined in Equation 16.19 and Equation 16.20. 

255 2 

PSNR=10l°g WJ[M (16.19) 


1 H W 

MSN = WVw E E - p L ) 2 (16-20) 

h—1 w = 1 

H and W is the height and width of the images P and P' respectively. Ph w 
and P' hw are the corresponding pixel values, and MSE is the mean-square-error 
between the two images. 

In the first experiment, to compare the visual quality (i.e., PSNRs) between 
the cover images and the corresponding stego-images in Lin-Tsai’s scheme, 
Yang et al.’s scheme, Chang et al.’s scheme, and ours, we took the image ” Jet- 
F16 ’ as the secret image and the images ” Lena” , ’’Pepped’, and ” Baboon” as 
the cover images, as shown in Figure 16.27. Figure 16.28 demonstrates the 
experimental results. The PSNRs of different schemes reveal that the visual 
quality of the stego-images generated by our scheme is the best of the schemes 
compared in our experiments. 

To evaluate the visual quality of the recovered gray-scale images, we com- 
pared the PSNRs of the reconstructed grayscale images and the original secret 
image in Figure 16.29. From Figure 16.29, we can see the PSNR of Jet-F16, 
which is extracted from ” Lena!' , ” Baboon” and ” Pepped' , is larger than 30 dB. 
It means that not only does the revealing function of our scheme work well 
but also that the visual quality of the secret grayscale image is acceptable. 

In addition, storage space and stego-image transmission time are important 
issues in secret sharing. Consequently, the pixel expansion problem should be 
eliminated or minimized with any useful secret image sharing scheme. In other 
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FIGURE 16.27 

The test images. 


words, the size of the cover images used in the sharing algorithm should be no 
larger than that of their secret images. However, the cover images produced 
during previous research, which are based on a polynomial approach [9,15,28], 
are much larger than their secret images. The cover-to-secret image size ratios 
of the existing schemes and the proposed scheme are listed in Table 16.1 for 
comparison. From Table 16.1, we can see the cover size/secret size of our 
scheme is the smallest and the most satisfactory. 

To evaluate the capacity to identify a region of the secret image that has 
been tampered with, we compared the proposed scheme, Lin-Tsai’s scheme, 
Yang et al.’s scheme, and Chang et al.’s scheme using some manipulated stego- 
images that satisfy the parity check policy (shown in Figure 16.30). 

Both Figure 16.30 and Table 16.2 show the experimental results for the 
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scheme 


PSNS= 38.08 dB 


PSm= 38.17 dB 


PSm= 38.10 dB 


scheme 


PSNS= 36.09 dB 


36.11 dB 


PSNR=36A3 dB 


scheme 


PSNR= 36.89 dB 


PSNR= 36.91 dB 


PSN8=36.96 dB 


scheme 


FIGURE 16.28 

The experimental results for comparing the PSNR among the past work and 
ours. 
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PSNR=30.69 dB 


PSKR=30.69 dB 


PSKR=30.69 dB 


Recovered 

grayscale 

image 


Original 

secret 

image 


FIGURE 16.29 

The visual quality of the reconstructed grayscale image. 


various schemes. These results reveal that, among Lin-Tsai’s scheme, Yang et 
al.’s scheme, and the proposed scheme, our scheme provides the best authen- 
tication capability. In Lin-Tsai’s scheme, there is only one pixel for each block 
undergoing parity check. As a result, the authentication capability is not very 
good. 

In Yang et al.’s scheme, four pixels of each block all undergo the procedure 
using a hash function. However, their final check bit is computed by using an 
XOR operation. So, their probability of successful authentication should re- 
main at 50%. In our scheme, two check bits are adopted and the probability 
of successful authentication could be increased to 75%. On the other hand, 
compared with Chang et al.’s scheme, in which four check bits are adopted 
and authentication is implemented by using CRT (the Chinese Remainder 
Theorem), our proposed scheme has a lower detection ratio while maintaining 
lower computation complexity. However, because the set of shadows and the 
reconstructed secret image are generated through simple operations, no com- 
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(a) Original ste go -image 
Pepper 


(b) Obvious tampered 
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(c) XJnobvious tampered 
edition 


Tampered 

area 


Verifying 
results of 
Lin-Tsai's 
scheme 


Verifying 
results of 
Yang et 
al.’s 
scheme 

Verifying 
results of 
Chang et 
al.’s 
scheme 

Verifying 
results of 
the 

proposed 

scheme 



FIGURE 16.30 

Three tampered stego-images. 
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TABLE 16.1 

The cover-to-secret image size ratios of the 
existing schemes and the proposed scheme. 


Schemes 

Lin-Tsai’s scheme 

Yang et al.’s scheme 
Chang et al.’s scheme 
Our scheme 

Cover size / secret size 

4 

4 

2 

2/3 

TABLE 16.2 

The detection ratios of different schemes. 

Schemes 

Detection ratios (DR) 

Lin-Tsai’s scheme 

0% 

Yang et al.’s scheme 

52% 

Chang et al.’s scheme 

97% 

Our scheme 

79% 


putational complexity or pixel expansion occurs with our scheme. Moreover, 
in practice, the nearly 80% detection ratio is sufficiently effective. 


16.6 Conclusions 

In this chapter, we propose a novel secret image sharing and authentication 
scheme in which the set of shadows and the reconstructed secret image are 
generated through simple operations, and no computational complexity or 
pixel expansion occur. The PSNR value of the reconstructed secret image is 
larger than 30 dB, and the visual quality of the reconstructed secret gray-scale 
image is acceptable. 

Some research reported in the literature uses steganography as with 
Shamir’s secret sharing scheme [9,15,28]. However, with these approaches the 
cover images must be many times larger than their secret images. For a se- 
cret image of H x W pixels, for earlier schemes (introduced in Section 16.2), 
the cover image should be 2 H x 2W pixels or 2 H x W pixels in size. Such a 
restriction requires more storage capacity in the cover image and consumes a 
larger bandwidth during transmission. Experimental results confirm that each 
shadow generated by our scheme is six times smaller than the secret image. 
Moreover, the ratio of cover image size and secret image size is reduced to 2/3. 
This is the primary advantage of our scheme over past work. To compare vi- 
sual quality between cover images and their corresponding stego-images with 
the earlier schemes and our proposed scheme, we used several images for our 
experiments. The experimental results are shown in Figure 16.29. The PSNRs 
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of the various schemes compared demonstrate that the visual quality of the 
stego-images generated by our scheme is the best. This is the second advan- 
tage of our scheme over earlier work. The third advantage of our scheme over 
past work is that, based on the check bits embedded, our scheme provides an 
effective solution for verifying the reliability of the set of collected shadows 
in the context of low computational complexity. Furthermore, experiments 
confirm that our proposed scheme is suitable for real-time applications. 
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17.1 Introduction 

An image secret sharing scheme (ISSS) divides a secret image into some 
shadow images (referred to as shadows) in a way that requires the shadows 
in a certain privileged coalitions for the secret reconstruction. However, the 
secret image cannot be revealed if they are not combined in the prescribed 
way. A typical ISSS is often a [k, n)-threshold scheme, where k is the thresh- 
old value to reveal the secret and n is the number of total shadows. One can 
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reconstruct a secret image by k or more shadows, while he cannot conjecture 
any information from less than k shadows. There are two major categories 
in ISSS: one is the visual cryptography scheme (VCS) and the other is the 
polynomial-based ISSS (PISSS). 

In the ( k , n)-VCS, a secret image is encrypted into n shadows by expand- 
ing each secret pixel into m (the pixel expansion) subpixels. Notice that the 
difference between the pixel and the subpixel is that the ’’pixel” denotes the 
secret pixel located in the secret image, and the ’’subpixel” means the pixel 
located in shadows. Actually, the size of a subpixel is the same as that of the 
secret pixel. Therefore, shadows are, in general, expanded. Any k participants 
may photocopy their shadows on transparencies and stack them on an over- 
head projector to visually decode the secret through the human visual system 
(HVS) without hardware and computation. However, stacking k — 1 or fewer 
shadows will not gain any information. The first VCS encrypted a halftone 
(black-and-white) secret image into noise- like shadows [11]; subsequently, most 
VCSs were dedicated to reducing the pixel expansion [5, 7, 16, 17, 18, 2]. 

Indeed the visual quality of the VCS is poor, which comes from its intrinsic 
property using the OR-operation for decoding. Contrarily, the PISSS can re- 
cover the secret image without any distortion, while it needs the computation. 
By directly adopting Shamir’s secret sharing scheme [12], a (k, n)-ISSS takes 
the secret pixel as the constant term in (fc— l)-degree polynomials to share the 
secret. To gain small shadows, Thien and Lin used all coefficients in a (k — 1)- 
degree polynomial to generate shadows with size 1 / k times to the secret image 
[13]. Afterwards, Wang and Su [15] further reduced the shadow size by using 
the Huffman code. Shadows in [13, 15] are noise-like, which shadows are of- 
ten suspect to censors. It would be better to design a (k, n)-ISSS with the 
ability of steganography, i.e. shadows look like a cover image (a pre-selected 
meaningful image). Actually, we can construct a ( k , n)-ISSS being provided 
with meaningful and meaningless shadows according to our need. Some (fc, 
n)-ISSSs with meaningful shadows were proposed [14, 21, 8, 19, 1, 4, 6]. For 
example, two user-friendly (fc, n)-ISSSs [14, 21] produced the shadow with a 
shrunken secret image on it. However, the portrait on shadows had already 
leaked the secret information, and thus this scheme is, strictly speaking, not 
a secret sharing scheme. Other (fc, n)-ISSSs [8, 19, 1, 4] can present any cover 
images on shadows. Lin and Tsai’s scheme [8] had the authentication capabil- 
ity to detect the faked shadows. The schemes in [19, 1, 4] improved Lin and 
Tsai’s scheme to solve the dishonest participant problem of authentication, 
enhance the detection ratio of manipulated shadows, and improve the visual 
qualities of shadows. 

A new type of ISSS with two decoding options was introduced recently, 
where the secret image is revealed both by stacking the transparencies and 
by computation. This scheme is referred to as two-in-one ISSS (TiOISSS). 
TiOISSS can decode secret images for preview by the HVS when a computer 
is temporarily unavailable. When the computer is available during the decod- 
ing scene, we then spend more computation to obtain a high-quality image for 
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high-end applications. Two TiOISSSs [6, 9] have been proposed. Both schemes 
can stack shadows to decode a halftone secret image by the HVS in the first 
stage, and then can perfectly reconstruct the gray-level secret image in the 
second stage. A possible application scenario of TiOISSS is described below. 
In a distributed multimedia system, n shadows of PISSS can be delivered in 
a distributed system where each shadow is stored in any distributed storage 
node. The failure of (n — k) shadows during transmission does not affect the 
reconstruction phase, as the secret image can be perfectly restored using k 
shadows. Suppose a fake shadow is received. The receiver spends consider- 
able computation and finally finds the received shadow is wrong. Because the 
reconstruction phase of PISSS is very computationally intensive, we can ap- 
ply the TiOISSS to save the computational time for verifying the validity of 
shadows. The receiver can first verify the shadows by visually previewing the 
secret without computation. After the successful verification, the receiver then 
recovers the original gray-level secret image by computation. In this chapter, 
we will briefly describe two TiOISSSs [6, 9], and also introduce our recent 
research result on TiOISSS published in [20]. 


17.2 Preliminaries 
17.2.1 PISSS 

A polynomial-based (k, n) secret sharing scheme was first proposed by Shamir 
[12], in which the secret data is encrypted into n shadows. Any k shadows can 
be used to reconstruct the secret, but any fc — 1 or fewer shadows learn no 
information. By taking the secret data as go (constant term) in the following 
(fc— l)-degree polynomial g{x) where p is a prime number, we could construct 
n shadows (xi,g(xi)) by choosing n different Xi, i £ [l,n]. 

g{x) = (g 0 + gix + ... + g k -ix k -i ) mod p. (17-1) 


Any k shadows (without loss of generality, we use k shadows (xi, g(xi)),i £ 
[1, k}) can be used to reconstruct the ( k — l)-degree polynomial g(x) by La- 
grange interpolation as follows. Afterwards, the secret data go can be deter- 
mined from go = g( 0). 


d( x ) g(x i) ( Xl _ X 2 )( Xl -x 3 )...(x\—xk) 


(x—X2){x—X 3 )...(x—X k ) 

. •l-X2)(xi-X 3 )...(x 
I r ,(rr \ {X-Xx)(x-X 3 )...(x-X k ) 

2 ' (X2-Xl)(x 2 -X 3 )...(x2-Xk) 

+ ' ' ' + 9(xk) mod p. 


(17.2) 


Through Shamir’s secret sharing scheme, we could take every secret pixel 
as go in a (k — l)-degree polynomial g(x) to construct n random grayscale 
values in shadows to construct a ( k , n)-PISSS. At this time, the prime number 


© 2012 by Taylor & Francis Group, LLC 



466 


Visual Cryptography and Secret Image Sharing 


p = 251 is chosen such that g(x) is constrained between 0 and 250 and suitable 
to represent the conventional 8-bit grayscale or color images. Notice that the 
possible values of an 8-bit gray pixel are from 0 to 255, so the grayscale values 
(> 250) need to be modified to 250 and will cause distortion. Obviously, we 
can use the Galois Field GF( 2 8 ) rather than the ordinary arithmetic (mod 
251) to achieve a lossless scheme. Thien and Lin further reduced shadows with 
size 1/k times that of the secret image [13] by embedding the secret data in all 
coefficients of g(x). The formal encoding of Thien and Lin’s scheme is briefly 
described below. 

A secret image is first divided into r non-overlapping fc-pixel blocks, 
and every j-th (0 < j < r — 1) block includes the secret pixel values 
Vjk-,Pjk+ii ■■■iPjk+k-i ■ The (fc — l)-degree polynomial Sj(x) represents a 
shadow pixel associated with the j-tli block on shadows. 

Sj(x) = (pj k + pjk+ix + Pjk+ 2 X 2 + ... + p jk +k-ix k ~ 1 )inGF(2 8 ), (17.3) 

where x is often an image identification and 0 < j < r — 1. The value of Sj(x) 
is generated using the original pixel values PjkSPjk+u ■■■,Pjk+k - l included in 
the j-tli block. In this chapter, the Galois Field GF( 2 8 ) was chosen to achieve 
a lossless secret image. Because k pixels are processed each time, the size of 
the shadow image is 1/fc of the secret image. By reversing the encoding, the 
polynomial in (17.3) can be reconstructed from k shadow pixels; hence, the 
blocks can be recovered and finally the secret image is reconstructed. 

17.2.2 VCS 

The first VCS was Naor-Shamir’s (fc, n)-VCS to encrypt a halftone secret im- 
age into noise-like shadows. The authors used the whiteness (the number of 
white subpixels in a m-subpixel block) to distinguish the black color from the 
white color, i.e., ”m — /i”B”/i”W (respectively ”m — l” B”/”W) represents a 
white (respectively black) color, where h > l. A black-and-white (fc, n)-VCS 
can be designed using two base n x m matrices B\ and Bq with elements 
”1” and ”0” denoting black and white subpixels. When sharing a black (re- 
spectively white) secret pixel, the dealer randomly chooses one row of the 
matrix in the set C\ (respectively Co), which includes all matrices obtained 
by permuting the columns in Bi (respectively B 0 ) to a relative shadow. Let 
OR {Bi\r), * = 0,1, denote the ”OR”-ed vector of any r rows in Bi , and H(-) 
be the Hamming weight of a vector. The base matrices of the (fc, n)-VCS 
should satisfy the following conditions: 

(V-l). H (OR(Hi|r)) > (to — l) and H (OR(H 0 |r)) < (to — h )) for r = fc, 
where 0 < l < h < to. 

(V-2). H (OR (-B^r)) = H (OR(H 0 |r)) for r < (fc - 1). 

The first condition is often referred to as the contrast condition, and the 
secret image can be recognized due to their different contrasts of black and 
white colors. The second condition is the security condition that assures the 
(fc, n)-VCS of perfect secrecy. 
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Example 1. Construct a 

= 

' 10 ' 
01 

and Bq = 

' 10 ' 
10 


The secret is a printed-text image VCS 


A (2, 2)-VCS with B x = 


10 

01 


and Br, = 


10 

10 


has H (OR (Si 1 2)) = 2, 


H (OR(.B 0 |2)) = 1, and H (OR (l?i|l)) = H (OR(B 0 |1)) = 1, which satisfy 
(V-l) and (V-2) conditions. In the reconstructed image, the black color is 
2B0W and the white color is 1B1W (or 1W1B). However, each shadow con- 
tains 1B1W and 1W1B with the same frequencies so that one cannot see 
anything from his own shadow. Figure 17.1(a) is a black-and-white secret 


image 


VCS 


Two noise-like shadows (Shadow 1, Shadow 2) and the recon- 
structed image by stacking two shadows (Shadow 1 + Shadow 2) are shown 
in Figures 17.1(b), 17.1(c) and 17.1(d). The printed-text secret VCS can be 
revealed by HVS. □ 




(d) Shadow 1+Shadow 2 


FIGURE 17.1 

A (2, 2)-VCS of h = 1, l = 0, and in = 2: (a) the secret image (b) and (c) two 
shadows (d) the reconstructed image. 
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17.3 Previous Works 

Two TiOISSSs [6, 9] are briefly reviewed in the sequel. Jin and Lin’s scheme [6] 
applied VCS on a halftone secret image, which is obtained from a prescribed 
halftoning transformation. Lin and Lin’s scheme [9] combined the VCS and 
PISSS. Both TiOISSSs have stacking-to-see capability. By computation, both 
schemes could reconstruct the original gray-level secret image. The TiOISSSs 
in this chapter can be extended to share the chromatic secret image by ap- 
plying the approaches on C (cyan), M (magenta), and Y (yellow) bit planes, 
respectively. So, we only discuss the gray-level secret image. 

17.3.1 Jin et al.’s TiOISSS 

In [6], the gray-level secret image is transformed into a binary image by a 
digital halftoning method, in which every secret pixel is represented by nine 
black-and-white pixels (p c ,po,pi, . . . ,p?) in a 3 x 3-block as shown. Excluding 
the center pixel p c , every 8-tuple (po,Pi, ■ ■ • ,Pr) is uniquely decoded to the 
256 possible grayscale values (0 to 255), and simultaneously the pattern of 
nine pixels can simulate shades of gray. This halftoning method is most simi- 
lar to a patterning technique, which uses the black dots in a block to represent 
the intensity levels. The color of the center pixel p c can be chosen according 
to the halftone version of the original grayscale image to enhance the resolu- 
tion. Afterwards, the (k,n)-V CS is performed on this halftone secret image 
to construct n shadows. Suppose the gray-level secret image and the halftone 
images are I and I'. We first obtain / from I by the halftoning technique 
(see Table 2 in [6], which provides the complete mapping between I and I , 
also gives the nine grayscale levels in / to simulate the grayscale levels), and 
then arrange the pixels in a 3 x 3-block. Thus, we have \I \ = 9 x |/|. Apply 
a ( k , n)-VCS with the pixel expansion m on / , and then every shadow of Jin 
et al’s TiOISSS has the image size 9 x m x |/|. Jin et al’s TiOISSS has two 
decoding options. The first is stacking any k out of n shadows to get a vague 
halftone image by VCS, and the second is to reconstruct the gray-level secret 
image by a look-up table from the arrangement of (po,pi , . . . ,^7). 

Because we have two secret images (/ and I ), we herein define the pixel 
expansion of TiOISSS as the ratio of shadow size relative to the size of the 
original gray-level secret image. So, the pixel expansion of Jin et al’s ( k,n)~ 
TiOISSS is 

mjiN = 9m. (17.4) 


17.3.2 Lin and Lin’s TiOISSS 

Jin et al.’s TiOISS scheme has a terrible pixel expansion 9m. For example, Jin 
et al.’s (2, 2)-TiOISS has the pixel expansion 9m = 18 when using (2, 2)-VCS 
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columns in matrices. However, when using the 


combinations to rep- 


with m= 2. Recently, Lin and Lin proposed a TiOISSS [9] based on the VCS 
and PISSS to reduce the pixel expansion. A halftone secret image is encrypted 
into n shadows by (k,n)-V CS with the pixel expansion m, which every row 
contains b ”1” and w ”0” and m = b + w. It is obvious that every m-subpixel 

has ^ ^ combinations, and it can be used to represent about log 2 ^ ™ 

bits. Notice that in the conventional VCS, we can randomly permute all m 

TO 

w 

resent the information and simultaneously satisfy the security condition, we 
could only randomly choose the combination for one shadow and the remaining 
(n— 1) shadows are then determined according to the base matrices. Therefore, 

TO 

w 

other hand, we need (8 x \I\/k) bits to share the gray-level secret image I by 
(k, n)-PISSS. To assure we have enough space to hide the secret, the gray-level 
secret image is compressed by Jpeg or other compression techniques to reduce 
the information as (8 x \I\/(k x R)) bits where R is the compression ratio. In 
[9], the authors consider the case in which the halftone secret image and the 
gray-level secret image have the same size, i.e., |/| = \I |. 

TO 

w 

pression ration R should satisfy the following requirement to hide all informa- 
tion of a gray-level secret image. 


in a shadow, only (\I'\/ri) digits can be used to share log 2 


bits. On the 


As a result, (|/'|/n) x log 2 


> (8 x \I\/(k x I?)), and thus the com- 


R > (8 n / k x log 2 


in 

w 


(17.5) 


Since \I\ = \I |, finally, the pixel expansion of Lin and Lin’s (fc, n)-TiOISSS 


is 


i (C) 

l LIN 


(17.6) 

For example, the pixel expansion of Lin and Lin’s (2, 2)-TiOISSS when 
using (2, 2)-VCS with m = 2 is m y LIN = 2 less than in jin = 18. However, the 
gray-level secret image can be perfectly reconstructed in Jin and Lin’s scheme, 
while Lin and Lin’s scheme only recovers the compressed image. The greater 
compression ratio will degrade the visual quality of the secret image. 

Example 2. Construct Lin and Lin’s (2, 4)-TiOISSS and Jin and Lin’s 


(2, 4)-TiOISSS using Bi = 


' 1100 ' 


' 1100 ' 

0110 

and B 0 = 

1100 

0011 

1100 

1001 


1100 


Since 


TO 

w 


= 6 (there are six combinations: (1100), (0011), 
(1010), (0101), (1001), (0110)), log 2 ( Tn 'j = log 2 6 = 2.585 bits. Suppose 
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I is a 512 512 gray-level image. Lin and Lin’s TiOISS (2, 

TO 


the secret image 
4) scheme needs a compression ratio R = (8 n / k x log 


w 


= 32/(2 x 


2.585) = 6.19. We first compress the gray-level secret image I to a compressed 
image Ic to obtain the less embedded bits. Notice that even though \Iq\ has a 
lesser file size (the embedded bits), it has the same physical size of the original 
image |/|. Finally, the shadow size of Lin and Lin’s (2, 4)-TiOISSS is 1024 1024 


(note: m x \I |), and the pixel expansion is m LIN = to = 4. On the other hand, 
we need a 1536 x 1536(9 x |/|) halftone image for Jin et al.’s (2, 4)-TiOISSS. 
The shadow size of Jin et al.’s (2, 4)-TiOISSS is 3072 x 3072(9to x \I\), and 
the pixel expansion is m JIN = 9 m = 36. □ 


17.4 A New (k,n)- TiOISSS 

The VCS and PISSS have their respective features. As is known, the VCS has 
the vague reconstructed image and PISSS has a perfect reconstruction. The 
VCS has the distinctive stacking-to-see capability, while PISSS spends the 
computation for reconstruction. It is reasonable to adopt the stacking-to-see 
property of the VCS into PISSS to achieve a two-in-one scheme where the 
secret image is revealed both by stacking the transparencies and by compu- 
tation. Our new TiOISSS [20] is also a combination of the VCS and PISSS, 
which is somewhat similar to Lin and Lin’s scheme, but the way is completely 
different to that in Lin and Lin’s scheme. 

Jin et al.’s TiOISSS is a lossless version (i.e., no distortion in the secret 
image) but has a large pixel expansion. Lin and Lin’s TiOISSS is a compress- 
ible version. It compresses the secret image such that the shadow size has 
enough space to hide the information of a compressed image. Although Lin 
and Lin’s scheme reduces the pixel expansion of Jin et al.’s scheme, the re- 
constructed image has distortion. Obviously, Lin and Lin’s approach can be 
extended to the lossless version by expanding the halftone image with the size 

( TYl \ 

I to hide the original secret image. For the 
lossless version of Lin and Lin’s TiOISSS, the pixel expansion m^j N is 

= ( n / k ) x m x 8 A°g 2 ( w ) ' ( 17 - 7 ) 

For example, the pixel expansion of Lin and Lin’s (2, 4)-TiOISSS in Example 
2 (i.e. k = n = 2, to = 4, w = 2) is m^ JV = 24.76. 

Jin et al.’s scheme cannot be used in a compressible version because it 
uses a look-up table to recover the grayscale value of the pixel. The proposed 
TiOISSS has two versions — the lossless version and the compressible version. 
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For simplicity, we first describe the proposed TiOISSS, which reconstructs a 
lossless secret image. The compressible version is just an easy extension of the 
lossless TiOISSS, and will be discussed in Section 17.4.2. 


17.4.1 Design Concept 

Our design concept adopts the gray subpixel into the VCS, and this grayscale 
values simultaneously represents the output of the ( k — l)-degree polynomial 
in PISSS. In VCS, it is evident that when a subpixel is stacked by the white 
subpixel, its intensity is kept unchanged. While stacking two gray subpixels, 
we get a grayer color (a dark version of the color). Therefore, if we replace black 
subpixels with gray subpixels in the shadow, we still can use the whiteness in 
every m subpixel to distinguish the black color from the white color in the 
reconstructed image. Here, we adopt the widely accepted definition of color 
superimposition in [10] to define the color mixing function C(-) when stacking 
two subpixels with the grayscale values between 0 and 255. 

The grey level of the resultant pixel by stacking the two pixels can be 
expressed (approximately) as follows, in which each mixed color is produced 
by a color mixing function C(-). 


93 = C (gi,g 2 ) = Int ((31 x 3 2 )/255) , 


where Int(-) function maps a real number to the nearest integer. The values 
of <71, <72, 33 are any grayscale values between 0 and 255, and ”0” (respectively 
”255”) is a black (respectively, white) color. 

It is easy to verify 33 < 31 and 33 < 32, and this implies that stacking 
two gray pixels of 31 and 32 results in a grayer pixel of 33. For example, 
gi = C (31, 255) shows the grayscale value unchanged when stacking with the 
white pixel and 255 = C (255, 255) shows that the stacked result is a white 
color when stacking two white pixels. 

Example 3. Consider Example 1, and randomly use gray subpixels 3,; € 
[0,255] instead of black subpixels in B\ and Bq and do not change the white 
subpixel. 


As a replacement in B\ and Bq, we have B[ = 


9 1 0 
°3j j 


and B ' 0 = 


3i0 

L 9,0 J’ 


respectively. In the reconstructed image, it is observed that the stacked result 
in the black area (using B[) is lgilgj and the stacked result in the white area 
(using B' 0 ) is l3fclW or lWlgk, where gk < gi and gk < g-j- Through the 
whiteness, we can still visually reveal the secret. Each shadow contains l3ilW 
(or lWl3i) which is a gray-and- white and noise-like image, so that one cannot 
see anything from any shadow. In Figure 17.2(a) and Figure 17.2(b) are two 
noise-like shadows (Shadow 1, Shadow 2) and Figure 17.2(c) shows the recon- 
structed image (Shadow 1 + Shadow 2). It is observed that the secret VCS 


is also revealed but is a little blurred when compared with Figure 17.1(d). □ 
We call this VCS with the matrices B[ and B ' 0 the gray-subpixel based 
VCS (GVCS). Matrices B[ and B ’ 0 are the same as B\ and B 0 except that the 
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(c) Shadow 1+Shadow 2 


FIGURE 17.2 

A (2, 2)-GVCS of h = 1,1 = 0, and m = 2: (a) and (b) two shadows (c) the 
reconstructed image. 


gray subpixels replaced the black subpixels. Hence, GVCS holds the contrast 
and security conditions (V-l) and (V-2), and it is still a VCS. In this chapter, 
we use the notation (k,n,m, g)- GVCS, to denote a (k,n )~ GVCS with B[ and 
B'q , in which every row has g gray subpixels and (m — g) white subpixels. The 
whiteness, (m — g) white subpixels in every m-subpixel block, can be used to 
distinguish the black color from the white color. In GVCS, the grayness of 
the nonwhite subpixels in the reconstructed image is different from the pure 
blackness in the VCS, and it will distort the clarity (see Figure 17.1(d) and 
Figure 17.2(c)). 

In order to design a TiOISSS based on GVCS and PISSS, we should care- 
fully observe the distinguishing characteristics of both image secret sharing 
schemes. All characteristics of GVCS and PISSS are opposite; hence, combin- 
ing GVCS and PISSS creates the following problem. It is obvious that we need 
two secret images — a halftone secret image for GVCS and a gray-level secret 
image for PISSS. In our TiOISSS, the gray-level secret image is shared by 
PISSS. Then, we divide the halftone secret image into shadows by GVCS, in 
which the grayscale values in B[ and B' 0 are chosen according to the outputs 
of the [k — l)-degree polynomials in PISSS. Also, we need to determine the 
sizes of both secret images such that there are enough gray subpixels in GVCS 
to represent the outputs of PISSS. 
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We construct a (fc, n)-TiOISSS based on a (fc,n)-PISSS and a ( k,n,m,g )- 
GVCS to share a gray-level secret image I. For the lossless version, we first 
determine (8 x \I\/k) bits by PISSS. So, \I\/k gray supixels in each shadow of 
(k,n,m,g)- GVCS are required to hide (8 x \I\/k) bits. Since there are g gray 
subpixels in every m subpixels of (fc, n, m, <?)-GVCS, the halftone secret image 
7 for GVCS should be \I | = \I\/(k x g). So, the shadow size is m x |J |. For 
the lossless version, the pixel expansion of our (fc, n)-TiOISSS rripp 0 is 

m ( PKo = m/(k x g). (17.8) 

The formal encoding and decoding algorithms are described as follows. 
Some notations are defined first. 


Notation Used 

P(-) encryption of (fc, n)-PISSS. 

P' 1 (•) decryption of (fc,n)-PISS. 

I the gray- level secret image with the size |/|, which is used as the input 

of P(-). 

Pi the output shadows of P(7), i £ [1 ,n], with the size (\I\/k). 

G(-) encryption of (k,n,m,g)- GVCS with B[ and B' 0 , and the values 
of gray subpixels are chosen according to the gray pixels in P 

G" 1 (-) decryption of (k,n,m,g)~ GVCS (stack shadows and visually de- 
code the secret by HVS). 

H(-) halftoning function, transform and resize a gray-level image to a 
halftone image. 

7 a halftone secret image with the size 1 1 | = |7|/(fc x w) obtained from 
/=H(/). 

Gi the output shadows of G (7 ), i £ [l,n], with the size 

((m x \I\)/(k x g)). 


Encryption Algorithm of the Lossless Version of Our (fc, n)- 
TiOISSS 

Input: the gray-level secret image 7; the parameters k,n,m,g ; matrices 
B[ and B' 0 . 

Output: n shadows Gi,i £ [l,n]. 

1-1) Encrypt the secret image to obtain P,= P (/), i £ [l,nl. 

1-2) Obtain I from l'=H(7) . 

1-3) Output n shadows G,;=G(7 ), i £ [l,n]. 

Decryption Algorithm of the Lossless Version of Our (fc, n)- 
TiOISSS 

Input: any fc out of n shadows Gq , G* 2 , . . . , Gi k . 

Output: the halftone secret image 7 (Phase 1); the gray-level secret image 
7 (Phase 2). 
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/* Phase 1: does not need computation; visually decode the secret I by 
stacking k shadows; 

Phase 2: needs computation; decode the secret / by using Lagrange inter- 
polation */ 

Phase 1 (preview phase): 

2-1) G- 1 (G il ,G i2J ...,G < J; 

/* stack k shadows to visually preview the halftone secret image */ 

Phase 2 (perfect-reconstruction phase): 

2-2) Obtain (P h , P i2 , . . . , P ik ) from (G n , G i2 , . . . , G ik ) by discarding the 
white subpixels. 

2-3) /= P- 1 {P. ll ,P^...,P. lk ). 

/* use Lagrange interpolation to reconstruct the gray-level secret image 

7 


Our TiOISSS contains two decoding phases: the preview phase and the 
perfect-reconstruction phase. A halftone secret image can be visually pre- 
viewed by simply stacking shadows in Phase 1. The preview phase may be 
used when a computer is temporarily not available, or in a scenario verifying 
whether the shadows are correct or not in a distributed multimedia system, 
as mentioned in the introduction. On the other hand, by extracting the gray 
subpixels from shadows we may perfectly reconstruct the gray-level secret 
image when the computer finally is available (or after successful verification 
in a distributed multimedia system). We call the second decoding phase the 
perfect-reconstruction phase because we can gain a lossless secret image. 

Considering security, the proposed ( k , n)-TiOISSS is a combination of two 
(fc, n)-threshold schemes: the GVCS and the PISSS. So our scheme still retains 
the threshold property. An attacker could not stack less than k shadows to 
retrieve the black-and-white secret. Also, he cannot use the gray values of less 
than k shadows to reconstruct the (fc — l)-degree polynomial. Thus, combining 
these two ISSSs together assures the secrecy of the threshold scheme. 

Example 4 shows the proposed (2, 2)-TiOISSSs using different w and m 
to demonstrate different shadow sizes and the resolutions of the reconstructed 
images in the preview phase. 

Example 4. Construct two (2, 2)-TiOISSSs using base matrices: (1) B\ = 


10 

01 


and B 0 = 


10 

10 


(2) B 1 


110 

101 


and Bq = 


110 

110 


respectively. 


The secret image is 512 x 512 Lena from the USC-SIPI image database. 

A 512 x 512 gray-level Lena image I is shown in Figure 17.3(a). By (2, 
2)-PISSS, we obtain two 512 x 256 gray-level noise-like shadows P\ and P 2 , 
as shown in Figure 17.3(b) and Figure 17.3(c). 


Case (1) Bi 


10 

01 


B 0 = 


10 

10 


Since m = 2 and g = 1, we then resize and halftone I to get a halftone 
image I by H(-), and the size is \I \ = \I\/{k x g) = |/|/2. This 512 x 256 
halftone Lena is shown in Figure 17.4(a). Output two shadows Gi=G(I ), 
i= 1, 2, by using (2, 2, 2, 1)-GVCS, and the values of gray subpixels are chosen 
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FIGURE 17.3 

A (2, 2)-PISSS: (a) 512 x 512 gray-level Lena secret image (b) and (c) 512 x 256 
gray-level noise-like shadows. 
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FIGURE 17.4 

The proposed (2, 2)-TiOISSS using base matrices with h = 1,? = 0, and 
m = 2: (a) 512 x 256 halftone image (b) and (c) two 512 x 512 gray-and-white 
shadows (d) the previewed image. 
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(a) G 1 (b) G 2 (c) G 1 + G 2 


FIGURE 17.5 

The proposed (2, 2)-TiOISSS using base matrices with h = 1,1 = 0, and 
m = 3: (a) and (b) two 512 x 512 gray-and-white shadows (c) the previewed 
image. 


I = p- 1 

(A,p 2 ). 


' 110 ' 

; B 0 = 

' 110 ' 

101 

110 


according to the gray pixels in Pi and P 2 . In Figure 17.4(b) and Figure 17.4(c) 
are two gray-and-white shadows Gi and G 2 of the size m x \I \ = |/| (512 x 512- 
pixels). Figure 17.4(d) is the previewed image by stacking Gi and G 2 without 
computation. In the second phase of decoding, we can obtain Pi and P 2 from 
the gray pixels of Gi and G 2) and then reconstruct the gray-level Lena in 
Figure 17.4(a) by 

Case (2) Pi = 

Since m = 3 and g = 2, we need a halftone image I of the size is |J | = 
|/|/(fc x g) = |/|/4. Output two shadows Gi = G (I ), i = 1, 2, by using 
(2, 2, 3, 2)-GVCS, and the values of gray subpixels are chosen according to 
the gray pixels in Pi and P 2 . In Figure 17.5(a) and Figure 17.5(b) are two 
gray-and-white shadows Gi and G 2 of the size to x \I \ = 0.75 x |/| (512 x 384- 
pixels). Figure 17.5(c) is the stacked result by stacking Gi and G 2 . By the 
same approach in Case (1), we can also reconstruct the original gray- level 
Lena I. □ 

All the above schemes can visually reveal the secret by simply stacking 
shadows in the preview phase. The original gray- level secret image can be 
perfectly reconstructed in the perfect-reconstruction phase. Of two (2, 2)- 
TiOISSSs in Example 4, Figure 17.4(d) possess the better resolution of the 
previewed result, but Figure 17.5(c) has a lesser shadow size of 512 x 384 
pixels. 

Because our TiOISSS uses PISSS in Phase 2 for decoding, we can use 
the compression approach in [9] to hide the compressed image into shadows. 
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Suppose J(-) is a Jpeg-compression function, where Jc=J(7), and the com- 
pression ratio is R = (the number of bits in I / the number of bits in /c)> 1. 
At this time, the gray-level secret image I is compressed to Ic such that the 
information bits in Ic can be embedded into the halftone secret image I . 
By replacing I with Iq in our lossless TiOISSS, we could get the compress- 
ible TiOISSS. The formal encoding/decoding algorithm of the compressible 
version of our (k, n)-TiOISSS is omitted for brevity. 

In the lossless version of the proposed TiOISSS, since | / | = \I\/{k x g ), 
k > 2 and g > 1, then 1 1 \ < \I\. This observation implies that our TiOISSS 
could embed all information bits of lossless I into / , where | / | < |/|, for any 
values of (fc,n,m, g). So, actually, our TiOISSS does not need compression on 
I. However, to be fairly compared with the compressible version of Lin and 

Lin’s scheme, we use a compression ratio R = R LIN = ( n/k ) x 8/log 2 

such that we have the same image quality of the reconstructed image (a Jpeg- 
compressed version) as Lin and Lin’s scheme; at this time the size of our 
halftone secret image can be further reduced to \I | = \I\/{k x g x R). Then, 
the shadow size is m x \I'\ = ( m x \I\/(k x g x R)) and the pixel expansion 
of the compressible version rn'pp 0 is 

rn'ppo = rn/{k x g x R). (17.9) 



17.5 Experimental Results and Comparisons 


Example 5 shows three (2, 4)-TiOISSSs, Jin et al.’s scheme [6], Lin and Lin’s 
scheme [9] and our scheme [20], respectively; this example demonstrates the 
lossless version. The compressible versions of Lin and Lin’s (2, 4)-TiOISSS 
and our (2, 4)-TiOISSS are given in Example 6, where a compression ratio 

R = 6.5 > Rlin=( 4/2) x 8/log 2 f ^ J =6.19 is used. 


Example 5. Construct three lossless versions of (2, 4)-TiOISSSs: (1) Jin 
et al.’s scheme (2) Lin and Lin’s scheme (3) our scheme (the lossless version) 


using B i 


1100 


1100 

0110 

and Bo = 

1100 

0011 

1100 

1001 


1100 


A 512 x 512 gray-level Lena in Figure 17.3(a) is used as a secret image. By 
(2, 4)-PISSS, we first obtain four 512 x 256 gray-level shadows Pi — P4. To 
share all information bits in Pi, Jin et al’s scheme and Lin and Lin’s scheme 
need the 1274 x 1274 halftone secret image and the 1536 x 1536 halftone image, 
while our scheme needs the 256 x 256 halftone secret image (since k = g = 2, 
so \I | = \I\/(k x g) = |/|/4). The shadow sizes of Jin et al.’s scheme, Lin 
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and Lin’s scheme and our scheme are 3072 x 3072 pixels, 2548 x 2548 pixels 
and 512 x 512 pixels, respectively. Finally the pixel expansions are itijin = 
(3072 x 3072)/(512 x 512) = 36, mf} N = (2548 x 2548)/(512 x 512) = 24.76 
and m ( pl 0 = (512 x 512)/(512 x 512) = 1. □ 

Example 6. Consider Lin and Lin’s scheme and our scheme in Example 
5 but use the compressible versions with a compression ratio R = 6.5. 

By J(-), we compress the original Lena into the compressed image Ic with 
PSNR = 38.88 dB. Now, Lin and Lin’s (2, 4)-TiOISSS has enough space in 
/ (|/ | = \I\) to embed the information of Ic- By using Ic as the original gray- 
level secret image in our TiOISSS, we only need the 201 x 201 halftone secret 
images for sharing information bits. For the compression version, the pixel 
expansions of (2, 4)-TiOISSS are m^? N = m = 4 and mp^ 0 = m/ ( kxgxR ) = 
1/R = 1/6.5 = 0.154. □ 

When comparing the pixel expansions among these three TiOISSSs [6, 9, 
20], we consider the lossless version. This is a fair approach since all three 
schemes can reconstruct the same quality of the reconstructed image. From 
Equations (17.4), (17.7), and (17.8), it is obvious that our pixel expansion 
m Pi?.0 < 171 jin (si nce k >2 and g > 1, so m/{k x g) < m/2 < 9m). When 
comparing m^/j N and m'ppQ, one can verify that our TiOISSS has the lesser 
pixel expansion than Lin and Lin’s TiOISSS for most values of k , n, and m. 
In the following theorem, we theoretically prove that m^pp 0 < w hen 

both TiOISSSs use Naor-Shamir optimal (n, n)-VCS, Naor-Shamir optimal 
(3, n)-VCS, and Naor-Shamir (2, n)-VCS [11]. 

Theorem: The pixel expansion m"pp Q = m/(k x g) of the proposed (k, n)- 

TiOISSS is lesser than the pixel expansion rn// r / ; = ( n/k ) x mx 8/log 2 

of Lin and Lin’s TiOISSS when using Naor-Shamir optimal (n, n)-VCS, Naor 
Shamir optimal (3, n)-VCS, and Naor-Shamir (2, n)-VCS. 

Proof: When using Naor-Shamir optimal (n,?r)-VCS (note: k = n) with 
m = 2 ( ' Tl ~ 1 ), w = g = m/2, we have 



^lin = ( n /k ) xmx 8/log 2 ^ 

: 8m/log 2 ( (m/2) , T ; ! (m/2)! ) = 87 


= m x 8/log 2 


= 8m/log 2 ( (m/2) , T ; ! (m/2)! ) = 8m/log 2 ( Z ^y^ 2 ^ry^TT 1 ) 

> 8m/log 2 (?n m / 2 ) = 8m/ ((m/2) x log 2 (m)) = 16/ (log 2 (2^ ra_1 ))) 
= 2 4 /(n — 1) > 2 jn = m/{k x g) = vn>pp 0 (since g = m/2 and k = 


-- n). 
(17.10) 


When using Naor-Shamir (3, n)-VCS with m = 2n — 2, w = g = m/2, we 
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have 


m{ LiN = ( J */3) x m x 8/iog 2 ( ™ ) = (( 8 x m x ”)/3) /log 2 

= «8 x m x „)/3) /io g2 ( 

> ((8 x m x n)/3) /log 2 (m m / 2 ) = (16n/3) /log 2 (to) = (16n/3) / 
(log 2 (2n - 2)) 

> ((4n - 4)/3) / (log 2 (2n - 2)) = (2/3) x (2 n - 2) / (log 2 (2n - 2)) 

> 2/3 = m/(fc x g) = m^Q (since g = to/ 2 and fc = 3). 



(mi) 

When using Naor-Shamir (2, n)-VCS with to = n, w = m — 1, g = 1, we 
have 


TO 

It! 


= (4 x to x to) /log 2 


TO 

TO — 1 


to TOAT = ( n / 2 ) X TO X 8/log 2 
= (4to 2 ) /log 2 (to) = (4to) (m/log 2 (to)) > 4m 
> to/2 = m/(k x g) = to^ 0 (since g = 1 and k = 2). 

(17.12) 

From Equations (17.10), (17.11), and (17.12), we obtain m^ N > to^ 0 . 
The proof is completed. □ 

Table 17.1 lists the pixel expansions of some (fc, n)-TiOISSSs. Our scheme 
(respectively, Lin and Lin’s scheme) could choose different g (respectively, w) 
in the same m to reduce the shadow size. For example, both (2, 2)-TiOISSSs 


can use B i = 


110 

101 


) Bq — 


110 

110 


instead of B\ = 


10 

01 


j B 0 — 


10 

10 


to 


reduce the pixel expansions from rn^ 0 = 1 and m^j N = 16 to to^ 0 = 3/4 
and m^j N = 15.14, respectively. Our (2, 3)-TiOISSS could reduce the pixel 

ioo i r ioo ' 

expansion from 3/2 to 3/4 by replacing B\ = 010 , Bo = 100 with 

001 J [ 100 

, but the pixel expansion to^ 0 = 22.71 of Lin 



' 110 ' 


' 110 ' 

B x = 

Oil 

> B 0 — 

110 


101 


110 


and Lin’s scheme cannot be further reduced since 


to . 

w 


Our pixel expansions to^ 0 = m/(k x g). when using Naor-Shamir (2, n)- 
VCS, (3, n)-VCS and (n, n)-VCS, are n/2, 2/3 and 2/n, respectively. From 
Equations (17.4), (17.7), and (17.8), it is observed that m^j N is n-intensive 
and the value will increase when n increases whereas the other two schemes 
are n-invariant. On the other hand, Lin and Lin’s scheme and our scheme 
obtain more effective performance for large k than Jin et al.’s scheme because 
their pixel expansions are inversely proportional to the value of k. 

File sizes of shadows in Table 17.1 are represented in bits when using a 
512 x 512 gray-level secret image. The values in parentheses imply that we 
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send the raw data (use one bit ”1” (or ”0”) denoting the black (or white) 
color) to transmit the black-and-white shadows for Jin et al.’s scheme and 
Lin and Lin’s scheme. For example, when using the bitmap file format, the 
number of bits per pixel, which is the color depth of the image, typically can 
be 1, 4, 8, 16, 24, and 32. Even though both schemes use the color depth 1, 
our TiOISSS (use the color depth 8) still has the lesser file sizes of shadows for 
all cases in Table 17.1. For example, the file sizes of shadows for Jin et al.’s (3, 
6)-TiOISSS and Lin and Lin’s (3, 6)-TiOISSS are 23592960 bits («23.6 Mbits) 
and 5258608 bits (~5.3 Mbits) when using one bit to represent the color, while 
our (3, 6)-TiOISSS just needs only 1398101 bits (~1.4 M Kbits) when using 8 
bits to represent the color to transmit a gray-and-white shadow. Notice that 
when all schemes are using the same file format of the color depth 8, Jin 
et al.’s (3, 6)-TiOISSS and Lin and Lin’s (3, 6)-TiOISSS require 188743680 
bits («188.7 Mbits) and 42068864 bits («42.1 Mbits), respectively, which are 
significantly larger than 1.4Mbits. 

By the contrast definition (( h — l)/(m + l)) of VCS in [3], the contrasts of 
the previewed images are calculated and shown. Since the previewed image is 
used for verification in a distributed multimedia system; therefore, our primary 
task is to choose the suitable m and g to obtain the reduced shadow size to 
make the transmission and storage more efficient. 

To elucidate on the good results of the proposed scheme among the exist- 
ing TiOISSSs, some properties are evaluated: (1) the resolution of the recon- 
structed image, (2) the decoding complexity, (3) the shadow images (including 
the image pattern, the shadow size, the file size of shadow), and (4) the pixel 
expansion. A comparison among three TiOISSSs in [6, 9, 20] is listed in Ta- 
ble 17.2. All three schemes have dual modes of decoding — one for preview (or 
when a computer is temporarily unavailable) and the other for perfectly recon- 
structing the original gray-level secret image. Also, they all have a distinctive 
stacking-to-see property. Our scheme and Lin and Lin’s scheme use Lagrange 
interpolation for perfect reconstruction with the computational complexity 
0(k ) and no additional memory space, while Jin et al.’s scheme uses a 8 x 8 
ROM lookup table for reconstruction without computation. Our gray-and- 
white shadows have the benefit of reducing the physical size and the file size 
of the shadow when compared with other two TiOISSSs. 


17.6 Conclusion 

Our TiOISSS is a hybrid —half is the VCS and half is PISSS — with each spe- 
cialties employed: the easy decoding of the VCS in Phase 1 and the perfect 
reconstruction of PISSS in Phase 2. Our combination of the VCS and PISSS 
is different from that in Lin and Lin’s TiOISSS [9]. Lin and Lin use the com- 
binations in the m-subpixel block to represent the output value of PISSS, 
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TABLE 17.1 

Pixel expansions, file sizes of shadows, and contrasts of the previewed images for some (k, n)-TiOISSSs 


(k, n) 

Si 

Bo 

(m, w, g) 

Jin et al’s TiOISSS# 1 

Lin and Lin’s TiOISSS# 2 

the proposed TiOISSS 

contrast of 

previewed 

image# 4 

m# 1 

file size of shadow 

rrv^' z 

file size of shadow 


file size of shadow 

(2, 2)# 5 


10 

01 


10 

10 


(2, 1, 1) 

18 

37748736 

(4718592) 

16 

33554432 

(4194304) 

i 

2097152 

1/2 

(2, 2) 


no 

101 



no 

no 


(3, 1, 2) 

27 

56623104 

(7077888) 

15.14 

31750880 

(3968860) 

3/4 

1572864 

1/3 

(2, 3)# 5 


' 100 ' 
010 
001 



' 100 
100 
100 


(3, 2, 1) 

27 

56623104 

(7077888) 

22.71 

47626320 

(5953290) 

3/2 

3145728 

1/4 

(2, 3) 


■ no ‘ 
on 
101 



■ no 
no 
no 


(3, 1, 2) 

27 

56623104 

(7077888) 

22.71 

47626320 

(5953290) 

3/4 

1572864 

1/3 

(2, 4)# 5 


' 1000 
0100 
0010 
0001 



' 1000 
1000 
1000 
1000 


(4, 3, 1) 

36 

75497472 

(9437184) 

32 

67108864 

(8388608) 

2 

4194304 

1/6 

(2, 4) 


‘ 1100 
0110 
0011 
1001 



' 1100 
1100 
1100 
1100 


(4, 2, 2) 

36 

75497472 

(9437184) 

24.76 

51925480 

(6490685) 

1 

2097152 

1/5 

(3, 3)# 6 


■ 1001 
0101 
0011 



■ 1010 ■ 
1100 
0110 


(4, 2, 2) 

36 

75497472 

(9437184) 

12.38 

25962736 

(3245342) 

2/3 

1398101 

1/4 

(3, 4)# 6 


■ 111000 1 
110100 
110010 
110001 



■ 000111 ' 
001011 
001101 
001110 


(6, 3, 3) 

54 

113246208 

(14155776) 

14.81 

31058816 

(3882352) 

2/3 

1398101 

1/7 

(3, 4) 


mu 


■ 011111100 ' 
011110011 
011001111 
000111111 


(9, 3, 6) 

81 

169869312 

(21233664) 

15.02 

31499216 

(3937402) 

1/2 

1048576 

1/9 
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(3, 5)# 6 


' 11110000 ■ 
11101000 
11100010 
11100001 


' 00001111 ' 
00010111 
00011011 
00011110 


(8, 4, 4) 

72 

150994944 

(18874368) 

17.40 

36490440 

(4561305) 

2/3 

1398101 

1/11 

(3, 6)# 6 


- 1111100000 ■ 

1111010000 
1111001000 
1111000100 
1111000010 
. 1111000001 . 

- 0000011111 - 

0000101111 
0000110111 
0000111011 
0000111101 
. 0000111110 . 

(10, 5, 

5) 

90 

188743680 

(23592960) 

20.06 

42068864 

(5258608) 

2/3 

1398101 

1/14 

(4, A)* 7 


■ 10001110 ' 
01001101 
00101011 
00010111 


■ 01001101 ' 
01100011 
00111001 
00010111 J 


(8, 4, 4) 

72 

150994944 

(18874368) 

10.44 

21894264 

(2736783) 

1/2 

1048576 

1/8 


#1: mjiN=9m#2:m^ N = ( n/k ) X m X 8 / log 2 ^ ™ J #3 :m pflo = m /(^ x <?)#4: contrast=((/i — l)/(m + i)) 
#5: Naor-Shamir (2, n)-VCS #6: Naor-Shamir (3, rc)-VCS #7: Naor-Shamir (n, n)-VCS 
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TABLE 17.2 

A comparison among three TiOISSSs. 


TiOISSS 

Our scheme 
[20] 

Jin et al.’s 
scheme [6] 

Lin 

and 

Lin’s 

scheme 

[9] 

the resolution 

Phase 1 

U 

u 

U 

Phase 2 

OO 

OO 

OO 

the decoding 
complexity 

Phase 1 

H 

H 

H 

Phase 2 

the space complexity 

NO 

L-T 

(8x8 ROM) 

NO 

the computational 
complexity 

L-I 

(O(fc)) 

NO 

L-I 

(0(k)) 

the shadow 
images 

the pattern 

G-W 

B-W 

B-W 

the shadow size 

S 

M 

L 

the file size 

s 

M 

L 

the pixel expansion 

s 

M 

L 

the progressive decryption 

YES 

YES 

YES 


Notation: oo: Perfect reconstruction of the original image (note: for lossless version); U: 
the unacceptable image quality of reconstructed image; H: stack shadows and use HVS to 
preview the secret; L-I: use Lagrange interpolation for reconstruction; L-T: use a lookup table 
for reconstruction; G-W: gray-and- white noise-like shadows; B-W: black-and-white noise- like 
shadows; S, M, L: the values of shadow size, file size, and pixel expansion are small, medium, 
and large scales, respectively. 


while the value is embedded into GVCS to construct our TiOISSS. Finally, 
our scheme reduces the shadow size and the file size of the shadow. 
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darkness thresholds, 300 
discussions, 325 
Hamming weights, 301, 303 
misalignment deviation, 316 
misalignment tolerant VCS, 
319-325 

algorithm, 319-322 
decrypting algorithm, 321 
encrypting algorithm, 320 
simulations, 322-325 
misalignment with integer 
number of subpixels, 
302-309 

misalignment with less than one 
subpixel, 309-319 
large subpixels have better 
misalignment tolerance, 
316-319 

shares with slightly 
misalignment can still 
recover secret image, 
310-315 

nonzero coordinates, 299 
original secret image, 299 
pixel expansion, 297, 298 
preliminaries, 299-301 
recovered secret image, 299 
secret image 


deterministically recovered, 
315 

regions of deviation, 313 
shifted basis matrices, 302 
shifted scheme, 302 
shifted share matrices, 302 
visible space, calculation of, 298 
Almost ideal contrast, 265 
AM, see Amplitude modulation 
Amplitude modulation (AM), 105 
Annihilator color, 39, 42 
Applications, 329-350 

banking information, 329, 330, 
332 

barcode printing, 348, 349 
Cardano cryptography, 332, 334, 
337, 346 

compromise, 332 
lenses, 345, 346 
login, 333, 338 

man-in-the-middle manipulation 
attack, 331 
nested doll, 348 

online money transfers, 329, 331 
password, 334 
PIN, 333, 334, 337, 338 
plaintext attack, 339, 341 
redundancy of natural 
languages, 342 
refraction, 343-346 
secret sharing, original purpose 
of, 332 

security versus multiple use, 
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symbol-orientation, 332 
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transaction number, 331 
transaction server, 329 
’’transparency onto screen” idea, 
333 
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using PIN, 334-339 
trojan-secure confirmation of 
transactions, 333-334 
unknown plaintext attack, 341 
voting with receipt based on 
visual cryptography, 

347- 349 

Artificial image, 368 
Attack 

cipher-based, 404 
color image sharing, 382 
cover media and, 426 
fake share offerings, 405 
man-in-the- middle 
manipulation, 331 
plaintext, 339, 341 
polynomial-based image sharing, 
' 415 

secret cheating, 294 
secret image sharing, 427 
trojan manipulation, 333 
Authentication, image sharing with, 
425-461 

adopted techniques in proposed 
scheme, 434-445 
canny edge detector, 440-441 
edge lookup inverse halftoning 
technique, 441-443 
error diffusion technique, 
434-438 

interpolation technique, 
439-440 

Shamir scheme for secret 
sharing, 443-445 
Chinese Remainder Theorem, 
427, 432 


detection ratios of different 
schemes, 458 

edge-based lookup table, 441 
excursion skill, 437 
experimental results, 453-458 
Floyd and Steinberg error 
diffusion strategy, 434 
Gaussian filter, 440 
HyperText Markup Language, 
426 

least significant bits, 432 
lookup table, 441 
most significant bits, 452 
pixels 

binary representations of, 429 
positions of, 436 
proposed scheme, 445-452 
reconstruction and verifying 
phase, 449-452 

sharing and embedding phase, 
445-449 

related work, 428-433 
Chang et al.’s scheme, 

432-433 

Lin and Tsai’s scheme, 
428-430 

Yang et al.’s scheme, 430-432 
visual secret sharing, 426 
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Prevention scheme, 287 
Authentication-based steganography 
study, 404, see also 
Polynomial-based image 
sharing 

Auxiliary black pixels (ABPs), 9 
distribution, 13 
predetermined, 15 

B 

Barcode printing, 348, 349 
Bayer’s matrix, 104, 105 
BCB, see Borland C++ Builder 
Binary error diffusion, 3 
Binary secret sharing scheme (BSS), 
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Blue noise error diffusion, 3-5 
Borland C++ Builder (BCB), 85 
Bounds, see Contrast bounds 
BSS, see Binary secret sharing 
scheme 

C 

Canny edge detector, 440-441 
Cardano cryptography, 332, 334, 337, 
346 

Characteristic parameters, 132 
Cheating prevention, 281-296 

analysis of cheating prevention 
schemes, 294 

Authentication Based Cheating 
Prevention scheme, 287 
authentic conditions, 294 
Boolean matrix, 282 
cheating prevention schemes, 
287-293 

HCT1 and HCT2, 287 
HT, 289-290 
PS1 and PS2, 292 
TCH, 290 

contrast conditions, 283 
experiment, 288, 291 
Generic Algorithm, 290 
preliminaries, 282-286 
cheating in VC, 285 
visual cryptography, 282-285 
prevention of shares against 
cheating, 294 
security conditions, 283 
Chinese Remainder Theorem (CRT), 
427, 432 
Chord-areas, 68 
Cipher-based attacks, 404 
Clark-Wilson security model, 382 
Clustered-dot ordered dither, 104 
CMY model, see Cyan, Magenta, 
and Yellow model 
Color images, 31-56 

additive color model, 34 
CMY model, 34, 35 
color superposition, 32-39 


annihilator color, 39 
color vision and color models, 
32-37 

darkening problem, 38 
identity color, 39 
lattices, 37-38 

formal models for colored VCS, 
40-44 

annihilator color, 42 
annihilator presence, 43 
base matrices, 44 
contrast property, 40, 42 
distribution matrices, 41 
models for B&W-VC, 40 
models for Color- VC, 40-43 
safety property, 40 
SC, ND, and General models, 
43-44 

secret palette, 41 
security property, 42 
shares palette, 41 
strong contrast property, 42 
weak contrast property, 42 
light energy, 33 
other schemes, 54-55 
RGB model, 34, 35 
schemes for general model, 
52-54 

annihilator presence, 52 
secret palette, 52, 53 
shares palette, 52 
(2, 2)-threshold schemes, 
52-53 

(2, n)-threshold AS schemes, 
54 

schemes for ND model, 50-52 
annihilator presence, 51 
concatenation of matrices, 50 
upper bound, 52 
schemes for SC model, 44-49 
BDD schemes, 47 
CDD schemes and lower 
bound, 48-49 
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KY and YL schemes, 47-48 
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pixel expansion, 45, 47 
sharing passwords, 46 
trick, 45 

VV schemes, 45-46 
technically incorrect expressions, 
33-34 

Color visual cryptography, see also 
Color images 
annihilator color, 39, 42 
annihilator presence, 43 
base matrices, 44 
contrast property, 40, 42 
distribution matrices, 41 
efficiency within, 386 
formal model, 40-44 
models for B&W-VC, 40 
models for Color- VC, 40-43 
progressive, 387 
safety property, 40 
SC, ND, and General models, 
43-44 

secret palette, 41 
security property, 42 
shares palette, 41 
strong contrast property, 42 
weak contrast property, 42 
Commutative operation, 187 
Contrast bounds, 223-253 

approximate inclusion exclusion, 
227-232 

asymptotic optimal fc-out-of-n 
schemes, 241-243 
black subpixels, 226 
Boolean matrices, 225, 233 
bound, sharp, 231 
contrast, importance of, 224 
contrast trade offs for extended 
visual cryptography 
schemes, 244-251 
designs and codes, 232-236 
enhancing of contrast by 

nonstandard models, 251 
Fisher’s inequality, 235 
Hadamarcl matrix, 235 
integer vector, 246 


optimal contrast, 230 
optimal 3-out-of-n schemes, 
236-240 

pairwise balanced design, 234 
pixel expansion, 236 
Plotkin bound, 232 
preliminaries, 225-227 
visual cryptography scheme, 
formal definition of, 223 
Contrast property, 40, 42, 48 
CRC, see Cyclic Redundant Code 
CRT, see Chinese Remainder 
Theorem 

Cyan, Magenta, and Yellow (CMY) 
model, 34, 35 

Cyclic Redundant Code (CRC), 405, 
415 

Cylinder shares, 87, 92 

D 

Darkening problem, 38 
Data hiding 

authentication codes, 427 
halftone images, 356 
LSB scheme, 409 
secret image sharing, 382 
shares involved in, 396 
Data Hiding by Conjugate Error 
Diffusion (DHCED), 
359-363 

Data Hiding by Stochastic Error 
Diffusion (DHSED), 
356-359 

DBS, see Direct binary search 
Decoded image 

composition of shares, 14 
contrast loss, 7, 19 
HVC expansion, 19 
parallel error diffusion, 16 
quality degradation, 387 
shares, 21, 22 
Decomposing circle, 70 
Decrypting algorithm, 321 
Density pattern, 104 
Deterministic model, 129, 133 
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DHCED, see Data Hiding by 

Conjugate Error Diffusion 
DHSED, see Data Hiding by 

Stochastic Error Diffusion 
Digital rights management, 382 
Direct binary search (DBS), 14, 19 
Dispersed-dot ordered dither, 104, 
105 

Distribution matrices, 41 

E 

Edge-based lookup table (ELUT), 
441 

Effective block, 83 
Elementary blocks, 69, 74, 81 
ELUT, see Edge-based lookup table 
Encryption 

algorithm, 102, 194, 320 
histogram equalization before, 
115 

photograph visual cryptography, 
107 

process, photograph images, 119 
progressive visual cryptography, 
388 

random grids, 186, 190 
security of key used for, 382 
segment code, 332 
TiOISSS, 473 

transparency of shadow, 117 
visual cryptography scheme, 223 
Error diffusion 
binary, 3 
blue noise, 3-5 
constant, 15 
constrained, 4 

Floyd and Steinberg strategy, 

' 434 

halftone, see Halftone error 
diffusion 

image decoding, 19, 21 
image sharing with 

steganography, 434-438 
kernel, 352 
multitone, 5 


parallel, 16 

photograph visual cryptography, 
105 

samples of error filters, 106 
steganography in halftone 
images, 352-356 
visual secret sharing, 5-9 

construction of VSS scheme, 8 
notion and formal definitions, 
5-8 

EVC, see Extended visual 
cryptography 

EVCS, see Extended Visual 

Cryptography Scheme 
Excursion skill, 437 
Extended block, 59 
Extended visual cryptography 
(EVC), 19 

Extended Visual Cryptography 
Scheme (EVCS), 96, 99 

F 

Floyd-Steinberg error filter, 4 
FM, see Frequency modulation 
Forbidden sets, 256 
Frequency modulation (FM), 105 

G 

Galois Field, 390, 431, 466 

GAS, see General Access Structure 

Gaussian filter, 440 

General Access Structure (GAS), 99 

H 

Hadamard matrix, 235 
Halftone error diffusion, 1-28 
auxiliary black pixels, 9 
binary error diffusion, 3 
blue noise error diffusion, 3-5 
blue noise halftoning algorithms, 
4 

Boolean matrix, 7 
contrast condition, 8 
contrast of decoded image, 8 
diffused past errors, 4 
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direct binary search, 14, 19 
discussion, 19-20 

comparison with other 
methods, 19 
image decoding, 19-20 
improvement of image quality, 
19 

error diffusion constant, 15 
extended visual cryptography, 

19 

Floyd-Steinberg error filter, 4 
halftone visual cryptography, 3, 
4 

halftone VSS construction using 
error diffusion, 9-16 
distribution of SIPs and 
ABPs, 11-14 

generation of halftone shares 
via error diffusion, 14-16 
share structure, 9-11 
halftone VSS construction using 
parallel error diffusion, 
16-17 

Hamming weight, 7 
human visual system model, 18 
image quality 
discrepancy, 18 
improvement in, 19 
uniform, 18 

local geometric distortion, 26 
multitone error diffusion, 6 
parallel approach, 17 
preset pixels, 16 

quality of halftone shares, 17 -18 
quality index, 18 
quantization errors, 15, 16 
reconstructed image, 26 
scheme robustness, 20 
secret information pixels, 9 
security condition, 8 
share image quality, 21 
simulation results, 20-26 
thresholding block, 19 
visual cryptography, 2-3 
visual secret sharing, 5-9 


construction of VSS scheme, 8 
notion and formal definitions, 
5-8 

Halftone images, steganography in, 

351- 380 

artificial image, 368 
black pixels, 366, 367 
Data Hiding by Conjugate Error 
Diffusion, 359-363 
Data Hiding by Stochastic Error 
Diffusion, 356-359 
data hiding techniques, 356 
halftone pixel, probability 
distribution of, 353, 366 
image halftoning, 351 
intensity curves, 371 
Jarvis kernel, 354, 355, 356, 370 
least significant bit, 356 
ordered dithering, 351, 352 
output halftone value, 353 
performance analysis, 363-377 
review of error diffusion, 

352- 356 

Steinberg kernel, 353, 355, 356 
summary, 377 -379 
toggling, 360, 362 
trial halftone value, 361 
watermarking data, 352 
Halftone visual cryptography (HVC), 
4 

constrained error diffusion, 4 
expansion 

image decoding, 19 
SIP location, 11 

visually pleasing halftone image, 
18 

Hamming weight, 7, 301, 466 
Histogram linearization 

transformation, 115 
HTML, see HyperText Markup 
Language 

Human visual system (HVS), 18, 464 
HVC, see Halftone visual 
cryptography 

HVS, see Human visual system 
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HyperText Markup Language 
(HTML), 426 

I 

Ideal contrast, 250, 256 

Identity color, 39 

Image decoding, see Decoded image 

Image halftoning, 351, see also 

Steganography in halftone 
images 

Image secret sharing, 381-402, see 
also Steganography, image 
sharing with 

approaches for image sharing, 
389-396 

color image sharing based on 
Lagrange interpolation, 
389-392 

color image sharing based on 
moving lines, 392-396 
improved algorithm, 399 
Shamir’s secret sharing 
scheme, 389 
battlefield plans, 382 
bichromatic construction, 384 
Clark-Wilson security model, 
382 

color image reconstruction, 386, 
395 

color image sharing 
compressed domain 
processing, 399 
primitive example of, 385 
color visual cryptography, 
efficiency within, 386 
construction methods, 384 
digital rights management, 382 
experiment and evaluation, 
397-399 

fixed pixel expansion, 387 
Galois field, 390 
image halftoning, 387 
Lagrange interpolation, 389, 
391, 397, 399 
loss of key, 382 


lossless recovery scheme, 386 
monochromatic construction, 

384 

Peak-Signal-to-Noise Ratio, 388 
plurality of ways, 388 
redundancy in protection, 382 
secret key, backup mechanism 
to, 382 

secret sharing system, 382 
state of the art, 384-388 
threshold cryptography scheme, 
382 

X-position parameter, 396 
Image secret sharing scheme (ISSS), 
463 

Image sharing with steganography 

and authentication, 425-461 
adopted techniques in proposed 
scheme, 434-445 
canny edge detector, 440-441 
edge lookup inverse halftoning 
technique, 441-443 
error diffusion technique, 
434-438 

interpolation technique, 
439-440 

Shamir scheme for secret 
sharing, 443-445 
Chinese Remainder Theorem, 
427, 432 

detection ratios of different 
schemes, 458 

edge-based lookup table, 441 
excursion skill, 437 
experimental results, 453-458 
Floyd and Steinberg error 
diffusion strategy, 434 
Gaussian filter, 440 
HyperText Markup Language, 
426 

least significant bits, 432 
lookup table, 441 
most significant bits, 452 
pixels 

binary representations of, 429 
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positions of, 436 
proposed scheme, 445-452 
reconstruction and verifying 
phase, 449-452 

sharing and embedding phase, 
445-449 

related work, 428-433 
Chang et al.’s scheme, 

432-433 

Lin and Tsai’s scheme, 
428-430 

Yang et al.’s scheme, 430-432 
visual secret sharing, 426 

Ineffective block, 83 

Inverted-Pattern-LSB information 
hiding algorithm (IPLA), 
410 

IPLA, see Inverted-Pattern-LSB 
information hiding 
algorithm 

ISSS, see Image secret sharing 
scheme 

J 

Jarvis kernel, 354, 355, 356, 370 

L 

Lagrange interpolation, 389-392 

Least significant bit (LSB), 356, 432 
computed check bits and, 433, 
448 

data bits, 452 
data hiding, 409 
embedding technique, 356 
image sharing, 432 
modified, 432 
scheme, inverted pattern, 
409-410 

Lookup table (LUT), 428, 441 

LSB, see Least significant bit 

LUT, see Lookup table 

M 

Mach-Zehnder interferometer, 155 


Man-in-the-middle manipulation 
attack, 331 

Maximal contrast schemes, 260 
Maximum distance separable (MDS) 
codes, 163 

MDS codes, see Maximum distance 
separable codes 

Model (s) 

additive color, 34 
Clark-Wilson security, 382 
colored VCS, 40-44 
annihilator color, 42 
annihilator presence, 43 
base matrices, 44 
contrast property, 40, 42 
distribution matrices, 41 
models for B&W-VC, 40 
models for Color- VC, 40-43 
safety property, 40 
SC, ND, and General models, 
43-44 

secret palette, 41 
security property, 42 
shares palette, 41 
strong contrast property, 42 
weak contrast property, 42 
Cyan, Magenta, and Yellow, 34, 
35 

deterministic, 129, 133 
human visual system, 18 
nonstandard, contrast bounds, 
251 

probabilistic, 131 
Red, Green, and Blue, 34, 35 
Monochromatic-colored shares, 213 
Most significant bits (MSBs), 452 
MSBs, see Most significant bits 
Multiple secrets, visual cryptography 
for, 57-93 

absolute location of block, 73 
black block, 83 
Borland C++ Builder, 85 
chord- are as, 68 
cylinder shares, 87, 92 
decomposing circle, 70 
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decryption process, human 

visual ability to perform, 57 
distortion, 83, 87 
effective block, 83 
elementary blocks, 69, 74, 81 
encoded shares, 58, 61, 66 
encoding patterns, 59 
extended block, 59 
ineffective block, 83 
Naor and Shamir’s basic visual 
secret sharing scheme, 

59-61 

new problems, 91 
pixels 

binary, 59, 60 

corresponding, 62, 64, 68, 73 
encoding set of, 73 
expansion, 59, 80 
reconstructed, 59 
private key, 91 
random shares, 58 
secret binary images, 58 
sector blocks, 66 
transforming circle, 90 
visual multiple-secret sharing 
schemes, 68-91 
comparison and discussions, 
87-91 

encoding circle share A, 69-71 
encoding circle share B, 71-80 
experimental results, 85-87 
Feng et al.’s scheme, 83-84 
general algorithm, 80-83 
informal description, 68-69 
Shyu et al.’s scheme, 68-83 
visual secret-sharing schemes, 58 
visual two-secret sharing 
schemes, 62-68 
Wu and Chang’s scheme, 
64-68 

Wu and Chen’s scheme, 62-64 
white block, 83 

N 

Nested doll, 348 


Noise-encoding, 104 

Nonzero coordinates, 299 

O 

Online money transfer, 329, 331 

Optimal contrast, 230 

Ordered dithering, 104, 351, 352 

Output halftone value, 353 

P 

Passwords 

sharing, 46 

troj an-secure authentication, 

334 

Peak-Signal-to-Noise Ratio (PSNR), 
388 

Photograph images, extended visual 
cryptography for, 95-126 
amplitude modulation, 105 
basic visual cryptography 
schemes, 96-103 
Bayer’s matrix, 104, 105 
contrast condition, 100 
extended condition, 100 
extended visual cryptography 
scheme, 99-101 
General Access Structure, 99 
(fc, n) visual secret sharing 
schemes, 96-99 
random grids, 101-103 
reconstructed image, relative 
difference of, 100 
relative difference of shadow 
images, 100 
security condition, 100 
shadow images, relative 
difference of, 100 
uniform scheme, 98 
basis matrices, 98 
binary mage, encryption 
algorithm for, 102 
Boolean matrix, 96, 99 
clustered-dot ordered dither, 104 
continuous-tone image, 108 
dynamic ranges, 114 
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encryption, process of, 119 
extended condition, 100 
Extended Visual Cryptography 
Scheme, 96, 99 
frequency modulation, 105 
fundamentals of photograph 
visual cryptography, 
103-108 

clustered-dot ordered dither, 
104 

density pattern, 104 
digital halftoning, 103-105 
dispersed-dot ordered dither, 
104, 105 

error diffusion, 105 
image quality and related 
parameters, 106-107 
iterative and search-based 
methods, 105 
noise-encoding, 104 
ordered dither, 104 
photograph visual 

cryptography with basic 
schemes, 107-108 
pixel expansion, 106 
pseudo-contours, 104 
relative difference, 107 
thresholding, 104 
tone levels, 106 
General Access Structure, 99 
gray-scale value, 117 
histogram linearization 
transformation, 115 
misalignment tolerance, 116 
misalignment-tolerant 
photograph visual 
cryptography, 116-120 
results, 120 

theory and implementation, 
116-119 

noise-encoding, 104 
ordered dither, 104 
pixel expansion, 97 
progressive visual cryptography, 
386 


random dither, 104 
reconstructed image, 97, 100 
relative difference, 97 
secret image, 96 
secret information pixels, 112 
shadow images, 96, 113 
shares, 96 

superimposition of random 
grids, 102 
thresholding, 104 
triplet, constraint values of, 

114 

uniform scheme, 98 
variations of photograph visual 
cryptography, 109-115 
approaches to photograph 
visual cryptography, 109 
continuous-tone subpixel, 115 
error and secret diffusion, 
113-114 

positive and negative shadow 
images, 112-113 
random-dot shadow images, 
111 

secret information pixels, 112 
similar shadow images, 
111-112 

simultaneous iterative search, 
114 

tone adjustment, 114-115 
watermarking technique, 111 
PISSS, see Polynomial-based ISSS 
Pixel (s) 

annihilated, 52 
binary, 59, 60 

expansion, 21, 45, 47, 59, 80 
alignment problem, 297, 298 
color images, 45, 47 
contrast bounds, 236 
image secret sharing, 387 
photograph visual 
cryptography, 106 
probabilistic visual 

cryptography schemes, 128, 
133, 138, 142 
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visual cryptography schemes 
with reversing, 256 
visual secret sharing, 21, 111, 
175 

preset, 16 
reconstructed, 59 
reverse coding of, 148 
secret information, 9, 112 
Plaintext attack, 339, 341 
Polynomial-based image sharing, 
403-424 

authentication-based 

steganography study, 

404 

cipher-based attacks, 404 
Cyclic Redundant Code, 405, 
415 

experimental results, 418-420 
evaluating authentication, 
419-422 

fidelity analysis, 418-419 
fake shares, 409, 415, 422 
Inverted-Pattern-LSB 
information hiding 
algorithm, 410 
pixel recovery, 406 
polynomial-based sharing 
scheme, 405-407 
Lagrange interpolation 
scheme, 406-407 
Shamir’s secret sharing 
scheme, 405-406 
preliminaries and related works, 
407-412 

inverted pattern LSB scheme, 

409- 410 

Lin-Tsai scheme, 407-409 
scalable secret image sharing, 

410- 412 

Thien-Lin scheme, 407 
Yang et al.’s scheme, 409 
random bit string, 408 
Revised Algorithm of 
High-Capacity and 
Applications, 412 


Secret Embedding and 

Detecting Algorithm, 416, 
418 

steganography, purpose of, 404 
stego-block, 408, 409 
stego-image imperceptibility, 404 
Target Secret Image Recovery 
Algorithm, 416, 417 
Wang et al.’s scheme, 412-418 
main algorithms, 416-418 
secret image sharing, 412-414 
set-up authentication, 

414-415 

Polynomial-based ISSS (PISSS), 464, 
465 

Private key, 91 

Probabilistic visual cryptography 
schemes, 127-153 
base matrices, 131 
black subpixel, reconstructed, 

141 

canonical probabilistic schemes, 
133-135 

characteristic parameters of 
scheme, 132 

constructing probabilistic 
schemes, 142-147 
(2, n)-threshold probabilistic 
schemes with any pixel 
expansion, 144-147 
(n, n)-threshold probabilistic 
schemes with any pixel 
expansion, 142-143 
contrast thresholds, 130 
cryptographic paradigm, 128 
deterministic models, 128 
distribution matrix, 129 
novel probabilistic schemes, 142 
open problems, 150 
pixel expansion, 128, 133, 138 
probabilistic schemes with 
Boolean operations, 

147 150 

(2, n) scheme for binary 
images (Wang), 147-149 
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(n, n) scheme for binary 
images (Wang), 149-150 
probabilistic schemes with no 
pixel expansion, 135-138 
reconstructed black pixel, 141 
reconstruction phase, 148 
reverse coding of pixel, 148 
security property, 137 
subpixels, 129 

trading pixel expansion with 
probabilities, 138-141 
cardinality of collections, 140 
probabilistic schemes with 
given pixel expansion, 
138-141 

reconstructed black subpixel, 
141 

visual cryptography schemes, 
129-133 

deterministic model, 129-131 
probabilistic model, 131-133 
Progressive visual cryptography, 388 
PSNR, see Peak-Signal-to-Noise 
Ratio 

Q 

Qualified sets, 256 
Quantization errors, 15, 16 

diffusion to grayscale pixels, 16, 
17 

excessive, 15 
grayscale image, 4 
SIP-caused, 11 

R 

R.AHA, see Revised Algorithm of 
High-Capacity and 
Applications 
Random dither, 104 
Random grids, visual cryptography 
and, 185-221 

binary image, 189, 198, 208, 213, 
219 

binary random pixel, 186 
commutative operation, 187 


generic procedure, 191 
gray-level image, encryption, 206 
light transmission, 202, 203, 204 
mathematical induction, 199 
monochromatic-colored shares, 
213 

random grids, 186-188 

random pixel, random grid, 
and average light 
transmission, 186-187 
superimposition of random 
grids, 187-188 
subtractive model, primitive 
colors in, 206 

visual cryptograms of random 
grids, 189-219 
algorithms of (n, n)-VCRG 
for binary images, 196-205 
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temporary shadows, 179 
visual cryptography scheme 
using polarization of light, 
158-168 

(fc, n ) scheme, 159-168 
(2, n ) scheme, 158-159 
(n, n) scheme, 159 
visual cryptography scheme with 
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Black pixel 


White pixel 


Yellow pixel 


Magenta pixel 



Resulting pixel: black 


FIGURE 2.1 



Resulting pixel: red 


Pixels superposition: black and white (left) and colored (right). 
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Infrared Microwaves 


FIGURE 2.2 

Electromagnetic spectrum. 



FIGURE 2.3 

Additive color model with primaries red, green, and blue. 
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FIGURE 2.4 

Subtractive color model with primaries cyan, magenta, and yellow. 



( 100 , 100 , 0 ) 

( 100 , 0 , 100 ) 
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(50,90,30) 
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( 100 , 100 , 100 ) 
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o (20,50,80) 



( 100 , 100 , 0 ) 

(0,0,100) 



(0,0,0) 


FIGURE 2.5 

Examples of pixels superposition. 


(100,100,50) 

(100.50.100) 

(50.100.100) 

Q (50,50,50) 


f) (100,70,90) 
(60,90,80) 
( 20 , 20 , 100 ) 

(12,13,72) 





FIGURE 2.6 

More examples of pixels superposition. 
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FIGURE 2.9 

The w trick for the case of 4 colors. Subpixels with different colors are never 
superposed. 



FIGURE 7.9 

Results of Steps 1 and 2 of Algorithm 8 for VCRG-3 with respect to color 
image P in Experiment 3: (a) P; (b) P c , (c) P m , (d) P y ; (e) P c , (f) P m , (g) 
P y . 
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FIGURE 7.10 

Results of Step 3 of Algorithm 8 with respect to P m where Ey- 
crypt-cVCRG(P m , m, 3) was based upon Algorithm 4: (a) R ™, (b) R™, 
(c) R™ ; (d) Rf ® R™, (e) R™ ® R™, (f) R™ ® R™; (g) R™ (8) R™ ® R™. 
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FIGURE 7.11 

Results of Algorithm 8 for VCRG-3 with respect to P: (a) Ri, (b) R 2 , (c) 
R 3 ; (d) Ri ® R 2 1 (e) Ri ® R 3 , (f) R 2 ® R 3 ; (g) Ri ® R 2 < 8 > R 3 (based upon 
Algorithm 4); (h) R : ® R 2 ® R 3 (based upon Algorithm 5); (i) R 1 ® R 2 ® R 3 
(based upon Algorithm 6). 
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FIGURE 7.13 

Results of Algorithms 8 where Encrypt .cVCRG (P x , x , 4) was based upon 
Algorithm 4 for VCRG-4 with respect to P (Figure 7.9(a)): (a) R\, (b) R 2 , 
(c) R 3 , (d) R 4 ; (e) Ri ® R 2 - (f) Ri <S> R 2 < 8 > R 3 ; (g) Ri <S> R 2 ® R 3 ® R 4 - 
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(a) Original image and shares 1 and 2 



(b) Original image and shares 1, 2, and 3 


FIGURE 14.3 

Experimental results of image sharing based on the Lagrange interpolation in 
(a) and (b). 





(a) Original image (b) Shares 1 (c) Shares 2 


FIGURE 14.4 


The image sharing by using a high degree polynomial interpolation in (a)-(c). 
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FIGURE 14.8 

The experimental results of image sharing by moving lines. 



FIGURE 14.9 

The experimental results of image sharing by moving lines. 



FIGURE 14.10 

The experimental results of image sharing by moving lines. 



FIGURE 14.11 

Breaking the correlation of neighboring blocks in an image. 
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